Google researchers detail Project Big Sleep, formerly Project Naptime, which used an AI agent to discover a previously unknown and exploitable bug in SQLite
The company's experimental AI agent finds a previously unknown and exploitable software bug in SQLite, an open-source database engine.
PCMagMichael Kan
Context & Ripple Effects
SQLite had already been shown to be a high-consequence dependency when earlier flaws exposed Chrome to remote code execution in the prior Chrome-linked SQLite vulnerabilities. This report adds an agent-driven discovery method to that established software-supply-chain risk.
Subsequent coverage tracks Big Sleep from this experimental result to a critical SQLite issue said to be at risk of exploitation and a broader toolset that found flaws across popular open-source software. That progression makes the initial finding relevant as an early operational test of AI-assisted vulnerability research.
First-order effects
Google gains a concrete validation case for Project Big Sleep: its agent identified an unknown, exploitable weakness in SQLite rather than only analyzing known bug patterns.
SQLite maintainers and downstream software teams must assess and remediate a newly surfaced security issue in a widely reused open-source component.
Second-order effects
The result raises the bar for vulnerability-research teams: competing defenders have greater incentive to apply AI agents to codebase exploration and bug triage, not just conventional scanning.
As Big Sleep expands into a tool that found flaws across open-source projects in later Google, DeepMind and Project Zero research, maintainers may face more frequent and more actionable reports, increasing patch-validation and disclosure workload.
Third-order effects
AI agents can compress the time between code review and discovery of previously unknown flaws, making continuous, automated defensive research more important for shared software dependencies.
The same capability is dual-use: the later report of hackers using AI to discover and weaponize a zero-day suggests that the advantage from agentic discovery will depend on whether defenders can find, validate and fix issues faster than attackers can operationalize them.
The trend: This is an early data point in the industrialization of agentic security research, where AI is becoming a capability for finding novel vulnerabilities on both the defensive and offensive sides.
New era in cybersecurity. The first public example of an AI agent finding a previously unknown exploitable memory-safety vulnerability (0day) in widely used real-world software. It even beat @lcamtuf's AFL fuzzer to it. https://googleprojectzero.blogspot.com/ ...
New era in cybersecurity. The first public example of an AI agent finding a previously unknown exploitable memory-safety vulnerability (0day) in widely used real-world software. It even bet @lcamtuf AFL fuzzer to it. https://googleprojectzero.blogspot.com/ ...
Today I'm excited to share with you all that our security AI Agent called “Big Sleep” has found its first vulnerability in an open-source codebase! This has been a great collaborative effort between @GoogleDeepMind and Google Project Zero. https://googleprojectzero.blogspot.com/ …
Exciting work from @GoogleDeepMind and Project Zero: perhaps the first public vulnerability discovered using an LLM agent in a widely-used software component. Early days, but shows the promise of LLMs to find and fix vulnerabilities before they ever make their way into production
Today @Google Project Zero and @GoogleDeepMind shared how they've used an LLM to catch vulnerabilities in real world code with their project “Big Sleep.” This is a huge step for using AI to assist today's cyber defenders. https://googleprojectzero.blogspot.com/ ...
Our team has been working hard to harness the power of AI to make software more secure.✨🔐 Today we are excited to share a major milestone: our AI agent has discovered its first real-world security vulnerability! https://googleprojectzero.blogspot.com/ ... More info 🧵 [image]