The economics of finding software flaws have been blown apart. Google disclosed Thursday that its internal AI tools helped patch 1,072 security bugs in the last two versions of Chrome, a number that eclipses the 1,036 fixes shipped across the previous 23 releases over a two-year span. That’s not a gradual increase. It’s a hockey stick.
Chrome’s engineering director Doug Turner didn’t mince words about the shift. “LLMs have fundamentally shifted the economics of cybersecurity, transforming vulnerability discovery into an automated, industrial-scale operation,” he told TechCrunch. Google’s own white paper includes a chart showing the spike, with the latest versions — milestones 149 and 150, both released last month — dwarfing everything that came before. The company is using models like Gemini to find and fix bugs before attackers can exploit them.
This isn’t just a Google story. Microsoft had its own record-smashing month, patching 570 flaws during its scheduled Patch Tuesday, a jump the company also credited to AI-powered discovery. For years, security pros warned that AI would be a double-edged sword — letting defenders scale up, sure, but also handing attackers an industrial-grade bug-hunting machine. That prediction is now showing up in hard numbers.
What’s strange is who isn’t seeing the same explosion. Apple, by one independent count, has patched 482 bugs so far in 2026 — roughly on track with last year’s totals and, oddly, with what the company fixed way back in 2015. Apple didn’t respond to a request for comment. It’s an open question whether they’re not using AI in the same way, not finding as many bugs, or simply not disclosing them at the same clip. Either way, the gap in reported fixes is getting harder to ignore.
