Chrome Needs Twice-a-Week Patching Thanks to AI Bug Hunting
Chrome Needs Twice-a-Week Patching Thanks to AI Bug Hunting
由于 AI 漏洞挖掘，Chrome 需要每周进行两次补丁更新
Google’s Chrome browser has always been focused on pushing security updates. A decade ago it was controversial that the browser, the first to add automatic updates, distributed patches every six weeks. Now it’s the norm for critical, widely used software to get security fixes every few weeks, but as AI vulnerability hunting produces a torrent of bugs in any and all software, the quantity and frequency of patches is spiking—and the race to deliver them is on.
谷歌的 Chrome 浏览器一直致力于推送安全更新。十年前，作为首个加入自动更新功能的浏览器，它每六周发布一次补丁的做法曾引发争议。如今，关键且广泛使用的软件每隔几周发布一次安全修复已成为常态。然而，随着 AI 漏洞挖掘技术在各类软件中引发了漏洞潮，补丁的数量和频率正在激增——一场交付补丁的竞赛已经打响。
In a report published Thursday, the Chrome security team says the browser’s two major version releases in June included fixes for 1,072 security bugs—more patches than the team shipped in the prior 23 big releases combined. And though many of these bugs come from researcher submissions, the spike has largely been driven by the Chrome security team’s rapidly evolving internal process for using AI tools in vulnerability discovery, triage, and patch development.
在周四发布的一份报告中，Chrome 安全团队表示，该浏览器 6 月份的两个主要版本更新共修复了 1,072 个安全漏洞——这一补丁数量超过了该团队此前 23 次重大版本更新的总和。尽管其中许多漏洞来自研究人员的提交，但这一激增主要归功于 Chrome 安全团队在漏洞发现、分类和补丁开发过程中，对 AI 工具使用流程的快速迭代。
“In Chrome we’ve been using machine learning—using AI before it was called AI—to help find vulnerabilities in particular and automate security fuzz testing work since at least 2012. It’s been a huge part of how we find vulnerabilities and empower developers,” Parisa Tabriz, Chrome’s vice president and general manager, tells WIRED. “But I do think this year is very different. It really feels like an inflection point both for offense and defense.”
“至少从 2012 年起，Chrome 就一直在使用机器学习——在 AI 这个词流行之前我们就已经在用它了——来帮助发现特定漏洞并自动化安全模糊测试工作。这是我们发现漏洞和赋能开发者的重要组成部分，”Chrome 副总裁兼总经理 Parisa Tabriz 对《连线》(WIRED) 杂志表示，“但我确实认为今年非常不同。对于攻防双方来说，这似乎都是一个转折点。”
Chrome is already moving toward a new normal of pushing out a major release every two weeks with additional weekly security updates. But the frenzy of vulnerability discoveries has been so intense, and the team has had so much success incorporating new AI models and capabilities into the workflow of finding and fixing new bugs, that for now the group is piloting a cadence of releasing security fixes twice a week.
Chrome 已经在向一种新的常态迈进：每两周发布一个主要版本，并辅以每周的安全更新。但由于漏洞发现的频率过于密集，且团队在将新的 AI 模型和能力整合到发现与修复漏洞的工作流中取得了巨大成功，目前该团队正在试点每周发布两次安全修复的节奏。
“The way we ended up here is we had so many vulnerability fixes, so being able to provide two [updates per week] during this time, it made the most sense to us,” says Doug Turner, Chrome’s director of engineering. “Will that last forever? Who knows.”
“我们之所以走到这一步，是因为有太多的漏洞需要修复，因此在此期间能够提供两次（每周）更新对我们来说是最合理的，”Chrome 工程总监 Doug Turner 说，“这会持续下去吗？谁知道呢。”
Turner, like other security researchers, says he sees evidence that the AI vulnerability boom time (or apocalypse, depending on how you look at it) may not last forever. For mature, stable products like Chrome, at least, there seems to be a drop off at a certain point in the number of new vulnerabilities that will be discovered overtime once the bulk of bugs that can be found with AI have been fixed. This is partly because AI models can be trained to have an encyclopedic understanding of how software projects have evolved over time.
像其他安全研究人员一样，Turner 表示他看到了证据，表明 AI 漏洞挖掘的繁荣期（或者说是“末日”，取决于你怎么看）可能不会永远持续下去。至少对于像 Chrome 这样成熟、稳定的产品来说，一旦大部分能被 AI 发现的漏洞被修复，随着时间的推移，新发现漏洞的数量似乎会在某个节点出现下降。这部分是因为 AI 模型可以被训练，从而对软件项目随时间演变的过程拥有百科全书式的理解。
“We’re training our model such that it knows about every security vulnerability that we have seen in the past,” Turner says. “So every CVE, every bug the model knows about. And the second really cool thing is every line of code in Chromium’s history, it knows the reason why that line was changed.”
“我们正在训练我们的模型，使其了解我们过去见过的每一个安全漏洞，”Turner 说，“因此，每一个 CVE、每一个漏洞，模型都知道。第二件非常酷的事情是，对于 Chromium 历史上的每一行代码，它都知道这行代码被修改的原因。”
All of this context allows AI tools to home in on possible weaknesses across Chrome’s massive and complex codebase, including for features (say, printing) that are no longer under active development and may not attract as many human eyes anymore.
所有这些背景信息使得 AI 工具能够锁定 Chrome庞大且复杂的代码库中可能存在的弱点，包括那些不再处于活跃开发状态、可能不再吸引太多人类关注的功能（例如打印功能）。
Tabriz and Turner emphasize, too, that in addition to whack-a-mole patching, the Chrome security team is also extremely focused on the idea of making structural changes to how the browser is designed (such as rewriting portions of C++ code in the more secure, “memory safe” programming language Rust) so the software is no longer affected by whole categories of common bugs.
Tabriz 和 Turner 还强调，除了“打地鼠”式的补丁修复外，Chrome 安全团队也非常关注对浏览器设计进行结构性调整（例如使用更安全、“内存安全”的编程语言 Rust 重写部分 C++ 代码），从而使软件不再受整类常见漏洞的影响。
“There’s this near-term spike, but I do think there’s going to be a new equilibrium,” Tabriz says. “Across the industry I think it’s really important that people who are building and thinking about software security are incorporating AI into their development workflows. My highest hope is that everything gets more secure. But I don’t assume everything is going to just get better. I don’t think it’s going to come for free.”
“短期内会出现这种激增，但我认为最终会达到一个新的平衡，”Tabriz 说，“在整个行业中，我认为对于那些构建和思考软件安全的人来说，将 AI 纳入开发工作流非常重要。我最大的希望是所有东西都变得更安全。但我并不认为一切都会自动变好。我不认为这是可以不劳而获的。”