SQLite

Google reports that, working from Google Threat Intelligence information, the Big Sleep agent found a critical SQLite memory-corruption flaw (CVE-2025-6965) that Google says was known only to threat actors and at risk of exploitation. Google says it reported the flaw for patching before attackers could exploit it, says it believes this is the first time an AI agent directly foiled an in-the-wild exploitation effort, and says Big Sleep is being applied to open-source projects.

Google Project Zero and Google DeepMind report that Big Sleep, an LLM agent evolved from Project Naptime, found an exploitable stack buffer underflow in SQLite during a variant-analysis experiment seeded with newly landed commits. The bug was reported in early October 2024 and fixed the same day, before it appeared in an official release; Google believes this was the first public example of an AI agent finding such a memory-safety flaw in widely used software.