Google Project Zero

Google's vice president of security announced that Big Sleep had reported 20 vulnerabilities, mostly in open-source projects such as FFmpeg and ImageMagick, with details withheld pending fixes. A Google spokesperson told TechCrunch each flaw was found and reproduced by the agent without human intervention, with a human expert reviewing reports before submission.

Google reports that, working from Google Threat Intelligence information, the Big Sleep agent found a critical SQLite memory-corruption flaw (CVE-2025-6965) that Google says was known only to threat actors and at risk of exploitation. Google says it reported the flaw for patching before attackers could exploit it, says it believes this is the first time an AI agent directly foiled an in-the-wild exploitation effort, and says Big Sleep is being applied to open-source projects.

Google Project Zero and Google DeepMind report that Big Sleep, an LLM agent evolved from Project Naptime, found an exploitable stack buffer underflow in SQLite during a variant-analysis experiment seeded with newly landed commits. The bug was reported in early October 2024 and fixed the same day, before it appeared in an official release; Google believes this was the first public example of an AI agent finding such a memory-safety flaw in widely used software.