According to Google, its AI vulnerability-hunting system, BigSleep, independently discovered 20 serious vulnerabilities for the first time. A significant number of these vulnerabilities were found in open-source programs, such as the audio and video library FFmpeg and the ImageMagick image editing suite.
Heather Adkins, Google's Vice President of Security, stated that the BigSleep tool was developed by DeepMind's AI division and the Project Zero hacker team. The system has demonstrated high effectiveness, but still requires human intervention to ultimately verify the results.
"To ensure high report quality and practical value, human experts were involved before the report was compiled, but each vulnerability was discovered and replicated by an AI agent without human intervention," said Google spokesperson Kimberly Samra.
In 2024, BigSleep helped detect and prevent the consequences of a negative stack buffer overflow vulnerability and was able to implement an exploit in SQLite.
