The bug was thirteen years old. It survived a decade of fuzzers, bounty hunters, and some of the best security engineers in the world — and fell to an agent that was allowed to run: a harness built around it, and an environment its operators trusted enough to walk away from.

On July 30, 2026, Google published numbers that would have sounded like a typo a year ago: Chrome 149 and 150 shipped 1,072 security fixes between them — more than the previous 23 milestones combined — and 2026 has already crossed 1,800, with Chrome 151 adding another 370. SecurityWeek and BleepingComputer picked out the star exhibit: CVE-2026-3545, a CVSS 9.8 flaw in Chrome's navigation code that let a compromised renderer trick the browser into reading local files — a sandbox escape. It had been in the codebase for thirteen years. An agent found it, and Google patched it in Chrome 145 back in May.

Google has had strong models for years. Their own timeline runs LLM-assisted fuzzing in 2023, Project Zero's Naptime in 2024, Big Sleep finding real V8 bugs in 2025. The four-digit year arrived in early 2026, when they built an agent harness around those models — and the harness is the part worth studying, because the harness is the part you can have.

Anatomy of the harness

Strip the announcement to its mechanics and you get an architecture.

The harness feeds agents a knowledge base built from every previous Chrome CVE and the repository's full git history. A critic agent with its own separate context reads the SECURITY.md files and challenges what the finder proposes. The harness runs multiple passes over the same code, on the theory that a model that is non-deterministic in one run becomes thorough across ten. When a bug is confirmed, a fixing agent drafts candidate patches, the critic pushes back, and the two iterate in a loop Google describes as mimicking code review — then test-writing agents produce coverage across every Chrome platform, and only then does a human developer look at it. Triage got the same treatment: agents reproduce the proof-of-concept from an incoming report, date the bug's introduction, rate severity, and route it to an owner — work that used to cost an engineer five to thirty minutes per report, at a scale of hundreds of hours a month.

The human in that loop sits at the merge, reviewing a finished candidate fix with tests attached, rather than beside the agent approving each command. The run itself is autonomous. A thousand fixes in two releases is a fleet running overnight, with human judgment applied once, to what the fleet brings back.

Read the constraint list twice

Google's post says what earned the agents that freedom, in the part most coverage skipped. The agents analyze source code strictly at rest. They run on locked-down machines that have no general internet access. A dedicated setup intercepts every network request and checks it against a strict allowlist. Subagents are barred from modifying the local system or reading anything outside the source directories.

That list is the achievement's precondition. Autonomy is what produces scale, and autonomy is what you cannot grant while the boundary lives in your attention — while the only thing between the agent and your machine, your keys, and the open internet is you, watching. Google put the boundary in the wire instead: a network that refuses by default, a filesystem fence, an environment that holds the rules so the operators don't have to. Then they pointed the agents at one of the largest codebases on earth and let them run.

That constraint list is a Bromure profile, described from the outside.

Google's harness constraints, next to what a Bromure Agentic Coding profile does out of the box. Locked-down machines map to the disposable VM; intercept-and-allowlist maps to per-destination egress consent at the host proxy; the source-tree fence maps to the workspace the VM carries; review-at-the-merge maps to guardrails plus the diff you read at the end. One column took a platform team to build. The other is a profile you click.

The same environment, on your laptop

Bromure Agentic Coding starts from the same premise Google's harness does: the agent earns autonomy from the environment it runs in. Each profile runs its agent inside a disposable Linux VM on Apple Silicon, one hypervisor away from macOS, and every outbound request crosses the host proxy, where the destination is checked against the list you approved. The network refuses by default, the way Google's does. That is the license to let the agent run — start a task, close the lid, read the diff in the morning — because the rules hold whether or not you're watching.

And it makes the security work itself safe to hand over, because security work is attacker-shaped. Google's triage agents reproduce the proof-of-concept from incoming bug reports — they run the exploit to see if it's real. Try that on a bare laptop and the bug report runs the command on the machine that holds your keys. In a Bromure profile the PoC detonates inside the throwaway VM, where the credentials it can scoop are broker decoys — the real values live on the host and are injected only at the wire, only for approved destinations — and anywhere the payload tries to phone is a connection the proxy never lets leave. You can point an agent at your own crash reports, tell it to reproduce them, and mean it.

Scale, the other half of Google's number, is fleet work — multiple passes, parallel agents — and the product treats the fleet as a primitive. Type a task name and a git worktree profile gives that task its own branch, its own checkout, and its own agent in its own tab, each inside its VM; the nightly "sweep the codebase for bugs" pass and the "chase the flaky test" errand don't share a working tree or a blast radius. And for the hard bug — the one worth a second opinion — Fusion mode puts a panel of models on the same prompt with a judge to reconcile them, which is Google's multiple-passes insight applied at the moment it pays most.

Then the human sits where Google put them: at the gate. During the run, guardrails pause the destructive shapes — the force-push, the delete, the state-changing API call — for a dialog on the host, and everything else flows. At the end, you review a diff, the way Chrome's developers review a candidate fix with tests attached. That division of labor — judgment at the gate, autonomy during the run — separates an agent that autocompletes your evening from an agent that hands you numbers with commas in them.

Two stories, one lesson

Read this week's news next to last week's. Anthropic's disclosure showed what happens when the harness lies: isolation asserted in a prompt, a network that allowed everything, and agents that broke into three real companies while doing their homework. Google's post shows the same variable with the sign flipped: isolation enforced on the wire, and agents that fixed a thousand bugs and dug out a thirteen-year-old sandbox escape. The models brought the same talent to both stories; the environment decided what that talent produced.

That's the bet Bromure Agentic Coding makes on your behalf. You already have the models — the same class Google used. The ceiling on what a coding agent does for you is whether it lives somewhere you can afford to let it run. Give it a box that tells the truth, a wire that keeps the rules, and a gate where your judgment applies, and then do what the year of results argues for: install it, hand the agent a real task, and let it run.