Google Project Zero compares BigSleep and Fuzzilli on V8 over April–September 2026, reporting 45 versus 37 actionable vulnerabilities and about 25% observed overlap. A separate historical rediscovery experiment finds higher overlap; the report does not establish a controlled cost-efficiency ranking.
Why it matters
It shows why observed production overlap and controlled rediscovery measure different aspects of AI-assisted vulnerability discovery.
Key facts
As stated in the sources, with where to find them.
- Production counts filter out duplicates and unactionable reports and require fixes. The 25% overlap is 20 of 81 actionable vulnerability reports after the article’s deduplication process.Part 1: Production Statistics; Bugtracker Overlap
- BigSleep rediscovered about 62% of 112 selected historical bugs across 25 attempts per introducing commit, using Gemini 3.6 Flash. Selection excluded bugs incompatible with the evaluation build or allowed flags.Overlap Experiment
- Both systems run in production on newly added code with different scheduling. Cost optimization, scheduling and target selection limit generalization beyond this V8 comparison.Introduction; Part 1; Conclusion
Findings that cite this record
No tracked finding cites this record yet.
Key questions this bears on
- Is AI shifting the balance between finding and fixing vulnerabilities?Discovery is ahead. Verification, triage, coordinated disclosure and safe repair remain bottlenecks between AI findings and deployed fixes.
Sources
Related records
Oct 12, 2026
Sep 28, 2026
Oct 28, 2026
Oct 13, 2026
Sep 26, 2026
Oct 20, 2026