We built AI to hunt bugs faster than humans, and now we're patching software twice a week just to keep up with what we built.
The Summary
- Google patched more Chrome bugs in June 2026 than in the previous two years combined, driven entirely by AI-powered vulnerability discovery tools
- Chrome now requires twice-weekly security updates instead of the traditional monthly cadence, a direct result of LLMs finding exploits at machine speed
- Microsoft hit this inflection point first. Google's catching up. The exponential curve security researchers warned about two years ago is here.
- The implication: software isn't getting buggier. We're just finally seeing what was always there, and agents are better at looking than we ever were.
The Signal
June's two Chrome updates patched more vulnerabilities than the 23 updates before them. That's not a typo. Google's AI bug hunters found, in one month, more exploitable flaws than human security teams caught across nearly two years of continuous work. The company is now moving to a twice-weekly patch schedule because the old monthly rhythm can't keep pace with machine-speed discovery.
Both Microsoft and Google are experiencing the same exponential surge, exactly as security experts predicted when LLMs first showed competence at code analysis. The bugs were always there, baked into billions of lines of legacy code. Human auditors just couldn't find them fast enough. Now agents can read codebases the way you skim a menu, pattern-matching for vulnerabilities at a rate no human team could match.
"The bugs were always there. We just couldn't see them fast enough."
Here's what makes this different from past security automation:
- LLMs understand context across entire codebases, not just isolated functions
- They generate proof-of-concept exploits to verify findings, eliminating false positives
- They learn from each patched bug, improving detection on the next sweep
- They never get tired, never move to a different team, never forget what they learned last quarter
This is the good news story. Google and Microsoft are using AI to find their own bugs before adversaries do. But the same tools work just as well in the other direction. Every security researcher with access to Claude or GPT-4 can now audit software at scale. So can every state-sponsored hacking group. So can every ransomware crew with a decent API budget.
The patch treadmill just went from monthly to twice-weekly. Where does it go from here? Daily? Continuous? Google's move suggests we're heading toward rolling updates pushed the moment a fix is validated. Chrome might become the first major software product that's never actually "released" in the traditional sense, just continuously hardened by AI agents that never stop looking.
The Implication
If you're building software, this is your new baseline. The bugs you ship today will be found in weeks, not years. Your security team just became your most important hire, and they need to be fluent in AI-assisted auditing tools or they're already obsolete.
For users, the trade is straightforward: more frequent updates in exchange for tighter security. Your browser will restart more often. Your workflow will get interrupted. That's the price of living in a world where both attackers and defenders have access to the same exponential tools. The companies that adapt fastest will be the ones still standing when the patch cycle hits daily.