Agents in the Wild

Google's Big Sleep agent found an exploitable SQLite bug that fuzzing missed

Google Project Zero and DeepMind built Big Sleep, an LLM agent for vulnerability research. It found a stack buffer underflow in a development version of SQLite before the code was released.

Organization
Google (Project Zero & DeepMind)
Industry
Security Research
When
Nov 2024
Evidence
Research paper
Agents and tools
Big SleepGemini 1.5 Pro

Reported outcome

Found a previously unknown, exploitable memory-safety bug in SQLite; developers patched it the same day, before any release.

  • 0 (unreleased code)
    Users exposed
  • Same day
    Time to patch

Caveats

Described in a paper with a stated method. Peer review status varies.

  • Big Sleep was a research project at the time, not a product.
  • Google says traditional fuzzing did not find this bug, but one case does not show the agent beats fuzzing in general.

What the agent does

Researchers gave the agent a recently fixed SQLite bug as a starting point. The agent reviewed recent commits for a similar issue. It has a code browser, a debugger, a reporter tool, and a sandbox for Python scripts.

Why this works

This is variant analysis: "we found one bug, are there more like it?". It gives the agent a narrow, concrete target. The debugger lets it prove a crash instead of guessing.

What to copy

  • Start from a known bug and ask for variants. It is much easier than "find any bug".
  • Give the agent tools to prove findings (debugger, test harness), not only to read code.
  • Run it on recent commits, so bugs are caught before release.

Starter prompt

Written by us. Use only on code you own or are authorized to test.

Context: commit {fix_commit} fixed this bug:
{bug_description}

Task: review commits since {date} in {repo} for code with a similar
root cause (same function family, same input handling pattern).

For each candidate:
1. Explain the root cause in 2 sentences.
2. Write a minimal test input that triggers it.
3. Run it under the sanitizer build and paste the output.
Report only candidates you reproduced.

Sources

  1. From Naptime to Big Sleep — Google Project Zero, Nov 2024
  2. Google says its AI found SQLite vulnerability that fuzzing missed — SecurityWeek, Nov 2024

Added Oct 16, 2026. Spotted an error? Send a correction.

Get new use cases weekly

One short email. Sources included.

Related use cases