“The vulnerability is quite interesting, as well as the fact that the existing testing infrastructure for SQLite (both via OSS-Fuzz and the project’s own infrastructure) did not find the problem, so we investigated further in-depth,” the researchers noted in their blog. job.
This flaw, identified in early October before appearing in an official version, demonstrates the proactive potential of AI-assisted vulnerability scanning.
What makes this discovery particularly remarkable is its evasion of traditional detection methods.
“We believe this is the first public example of an AI agent discovering a previously unknown exploitable memory security issue in widely used real-world software,” Google security researchers wrote in the blog.
The power behind Big Sleep
The team’s success can be attributed to the Naptime project, later renamed Big Sleep as part of a broader collaboration between Google Project Zero and Google DeepMin, a framework introduced by Google in June 2024.
This innovative system is designed to enable large language models to perform vulnerability searches, mimicking the workflow of human security researchers.
Developed by Google’s Project Zero team, aims to leverage the advanced code understanding and reasoning capabilities of LLMs.
The framework’s name playfully suggests that it might one day allow researchers to sleep while AI handles the heavy lifting of vulnerability research.
At its core, Big Sleep’s architecture centers around the interaction between an AI agent and a target codebase.
The framework provides AI with a set of specialized tools designed to replicate the workflow of a human security researcher. These tools include:
