We use frontier AI models to review all our code but it hasn't replaced human review and humans need to review the output from it. It adds significantly more work and has resulted in a lot of issues being fixed.

We're not currently putting a large amount of resources into finding Linux, AOSP or Chromium vulnerabilities this way because many others are doing it with far more resources including Google. There are much higher impact things for us to focus on instead. Our focus remains systemic privacy and security improvement rather than case-by-case fixing of bugs. We definitely do that much better through shipping Linux and Android patches much faster than the Pixel OS along with fixing many issues ourselves but it's not our priority for the most part. Certain parts of it are priorities such as finding and fixing VPN leaks because Google doesn't consider it to be a relevant security issue.