Google Project Zero and Google DeepMind report that Big Sleep, an LLM agent evolved from Project Naptime, found an exploitable stack buffer underflow in SQLite during a variant-analysis experiment seeded with newly landed commits. The bug was reported in early October 2024 and fixed the same day, before it appeared in an official release; Google believes this was the first public example of an AI agent finding such a memory-safety flaw in widely used software.
Why it matters
It marked the move from benchmark results to a real, previously unknown vulnerability found by an LLM agent and fixed before users were exposed.
Key facts
As stated in the sources, with where to find them.
- The vulnerability was found and reported in early October and fixed by SQLite developers the same day; it never reached an official release.Introduction
- Existing testing infrastructure, including OSS-Fuzz and SQLite's own, had not found the issue.Introduction
- The agent was given newly landed SQLite commits and diffs and asked to look for related unfixed issues at HEAD (variant analysis).Section 'Methodology'
Findings that cite this record
Key questions this bears on
- Is AI shifting the balance between finding and fixing vulnerabilities?Discovery is ahead. AI finds real vulnerabilities faster than they are fixed, and simple checks overstate how often AI patches work.