Google fixed more Chrome bugs in June than over the past two years, thanks to AI

Original Article ↗ Hacker News Discussion ↗

Google claims that AI-assisted tools have enabled Chrome engineers to find and fix more security vulnerabilities in a recent release milestone than in the previous two years combined, prompting both interest and skepticism. Commenters note that large language models can indeed be powerful for code analysis, refactoring, and security review when tightly integrated with testing and tooling, but question how many bugs AI also introduces, what models are used, and how results are measured. The thread widens into concerns about hype-driven AI adoption, developer workflows, and the risks of Google’s growing control over the web platform, as well as the limits of AI for higher-level design, UX quality, and long-standing feature bugs.

Overall reaction to Google’s claim

  • Many see AI-assisted bug finding as plausible, especially for a huge, complex C++ codebase like Chrome.
  • Others are wary, viewing the blog post as marketing from a company heavily financially invested in AI.
  • Several note the article is about security bugs across release milestones, not all bugs in a single month.

How AI is being used for bugs and security

  • Commenters report strong results using LLMs for:
    • Static-style analysis, adversarial testing, and refactoring suggestions.
    • Large‑scale codebase scanning, duplicate bug detection, and security review triage.
    • Automatically searching for vulnerabilities before external researchers exploit them.
  • Analogy is drawn to fuzzers, linters, and formal tools: AI is “one more powerful automated checker,” but operating at a more human‑like reasoning level.

Skepticism, missing metrics, and potential downsides

  • Multiple people ask:
    • How many AI‑assisted fixes were reverted?
    • How many new bugs did AI introduce?
    • What is the false‑positive rate from AI bug finders?
  • Some suspect management KPI gaming (e.g., focusing AI on easy, low‑impact backlog bugs) and complain the post gives only “wins,” no failure data.
  • Others push back, arguing even many small or hard‑to‑exploit issues closing is a net security win, given exploit chains often need many bugs.

Did AI also create the bugs?

  • One line of criticism: AI‑generated code may inflate bug counts, so “fixing more” is not obviously good.
  • Counterpoints:
    • Chrome is ~20 years old; most of the serious bugs predate LLM use.
    • Repository stats don’t show a recent explosion of new code.
    • Even if AI introduces some bugs, breaking long exploit chains by fixing many issues is still valuable.

Broader AI-in-development experiences

  • Many report LLMs are very helpful for:
    • Code review, dependency and security updates, and small refactors.
    • Performance tuning when grounded in real telemetry/profiles and run in closed loops.
  • Others find LLMs poor at high‑level design, system simplification, or deep performance direction, and complain about “AI slop” in code and internal communication.

Concerns about Chrome, C++ and ecosystem control

  • Some see this as highlighting how brittle large C++ systems are and argue for memory‑safe rewrites (e.g., Rust), while others defend C/C++ with better tooling.
  • Separate from AI, several express discomfort with Google’s dominance over the web stack and ad‑driven product decisions; more bugs fixed doesn’t solve that structural issue.