> How many introduced a new bug?

I'd say that one is not really an issue. In 2012 the Pinkie Pie exploit chain already required chaining 6 bugs to lead to an exploit [1]. Since then we've seen chains requiring more than 10 bugs (!).

If you fix any one of those bugs, the exploit is non-functional anymore. Sorry out of luck.

So if, say, for every ten bugs you fix, you introduce two new ones then it's still a very net win. Unless of course it introduces a bug so bad it becomes a simple exploit not requiring a long chain of exploits.

But in the case of browsers we've only ever been moving to longer and longer chains of exploits required to pwn a browser.

A great many window of opportunities are closing for dark-side hackers / north korean intelligence etc.: there were probably exploit chains still open for exploitation in April that just got closed by Google.

If anything, besides the supply chains attacks in amateur-land, the world didn't stop working: projects (not just browsers but OSes too) are being hardened left and right.

Using AI to find potential bugs is an amazing use case and there really aren't many downsides.

> The post has counts for everything that went right and nothing for what could go wrong.

I'm not saying there aren't a few downsides but the benefits are just too good to ignore.

[1] https://blog.chromium.org/2012/05/tale-of-two-pwnies-part-1....