GoKawiilOur goal is for every one of these steps to happen as quickly as possible.
Finding vulnerabilities
The Chrome Security team has been using LLMs for years. In 2023 we developed ways to use LLMs to increase security fuzzing coverage and performance. In 2024, we worked with Project Zero on Naptime, giving LLMs specialized tools for vulnerability research. And in 2025, we collaborated with DeepMind and Project Zero on Big Sleep, an AI vulnerability discovery agent that successfully found bugs in the V8 JavaScript engine and graphics stack.
In early 2026, we built an agent harness that used Gemini to find vulnerabilities across the broader Chrome codebase with higher efficiency and lower false positives. One of the bugs we found was a sandbox escape that would allow a compromised renderer to trick the browser into reading local files — a bug that quietly survived in our codebase for more than 13 years! For many of us, this moment cemented the potential of AI-powered vulnerability detection.
From there, we improved on our vulnerability finding agent harness by:
Adding support for model interoperability to leverage the unique strengths of both open-weights and proprietary models.
Building a knowledge base of Chrome, including all previously identified CVEs and Chrome’s entire Git history, to extend the LLMs reasoning capacity past its training data.
Encouraging developers to add SECURITY.md files, which help models better understand trust boundaries and develop an accurate view of the threat model.
Adding a “critic” agent with a separate context to consume these SECURITY.md files.
Introducing the ability to run vulnerability finding models over the codebase multiple times to account for model non-determinism and model improvements over time.
... continue reading