Chronicle/Defense & research

Google reports Big Sleep found and reproduced 20 vulnerabilities in open-source projects

Aug 4, 2025DefenseVulnerability disclosureSignificance assistant-drafted

Google's vice president of security announced that Big Sleep had reported 20 vulnerabilities, mostly in open-source projects such as FFmpeg and ImageMagick, with details withheld pending fixes. A Google spokesperson told TechCrunch each flaw was found and reproduced by the agent without human intervention, with a human expert reviewing reports before submission.

Why it matters

It documents a human-in-the-loop reporting model for AI-found bugs at a time when maintainers were complaining about low-quality AI reports.

Key facts

As stated in the sources, with where to find them.

Big Sleep found and reported 20 flaws, mostly in open-source software such as FFmpeg and ImageMagick; issues are tracked on Google's issue tracker, with details withheld until fixes.TechCrunch article
Google spokesperson Kimberly Samra said each vulnerability was found and reproduced by the agent, with a human expert in the loop before reporting.TechCrunch article

Findings that cite this record

No tracked finding cites this record yet.

Key questions this bears on

Is AI shifting the balance between finding and fixing vulnerabilities?Discovery is ahead. AI finds real vulnerabilities faster than they are fixed, and simple checks overstate how often AI patches work.

Sources

Announcement of the first 20 vulnerabilities found by Big SleepHeather Adkins, Google (X)Aug 4, 2025Primary sourceAccessed Sep 26, 2026
Google says its AI-based bug hunter found 20 security vulnerabilitiesTechCrunchAug 4, 2025Secondary sourceAccessed Sep 25, 2026

Related records

Jul 15, 2025

Google says Big Sleep found SQLite CVE-2025-6965 before attackers could exploit it

DefenseVulnerability disclosureGoogle, Google DeepMind, Google Project Zero

Nov 1, 2024

Google's Big Sleep agent finds exploitable stack buffer underflow in SQLite before release

DefenseVulnerability disclosureGoogle Project Zero, Google DeepMind, SQLite

Sep 2, 2026

Google releases Gemini 3.8 Flash Cyber for trusted defenders, emphasizing automated patching

DefenseTool releaseGoogle, Google DeepMind, Collinear

Aug 8, 2025

AIxCC final: Team Atlanta wins as systems patch 43 of 54 found synthetic bugs and find 18 real ones

DefenseCompetitionDARPA, ARPA-H, Team Atlanta

Oct 6, 2025

Google DeepMind introduces CodeMender, an agent that patches and hardens code, with 72 upstreamed fixes

DefenseTool releaseGoogle DeepMind, Google

Sep 24, 2026

Google's PageBreak agent finds over 500 XSS bugs in its own web apps using deterministic validators

DefenseTool releaseGoogle

Organizations: Google, Google DeepMind, Google Project Zero, FFmpeg, ImageMagick
Topics: Vulnerability discovery
Attack surface: Human approver
Methods: AI vulnerability discovery for defense
Benchmarks and tools: Big Sleep
Fide research: FID-076: Authorization boundaries and AI control in cybersecurity
Record: google-big-sleep-20-vulnerabilities-2025 · added 2026-09-25

Cite this record

Fide AI. "Google reports Big Sleep found and reproduced 20 vulnerabilities in open-source projects." Agentic Cyber Explorer, record google-big-sleep-20-vulnerabilities-2025. https://agentic-cyber-explorer.pages.dev/events/google-big-sleep-20-vulnerabilities-2025/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-google-big-sleep-20-vulnerabilities-2025,
  author = {{Fide AI}},
  title = {Google reports Big Sleep found and reproduced 20 vulnerabilities in open-source projects},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/events/google-big-sleep-20-vulnerabilities-2025/},
  note = {Record google-big-sleep-20-vulnerabilities-2025; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Spotted an error? Suggest a correction.