← The impacts · AItopiaOrAImageddon?

entry · p2026-09-06-142 · validated

Big Sleep (Google Project Zero / DeepMind)

we found this issue before it appeared in an official release, so SQLite users were not impacted
tech
big-sleep
passes the definition as
an LLM agent fit to code and text, run as a variant-analysis fuzzing/reasoning agent over real codebases
from
2024-10
region
world
domain
safety
side
benefit
people
0 SQLite users impacted by the flaw (2024-11-01)
effect
1 vulnerabilities (2024-11-01) — an exploitable stack buffer underflow in SQLite found and fixed the same day, before it reached any official release
reversible
yes
who holds the switch
owner:Google
attribution
named
source kind
primary
the statistic
In early October 2024 Big Sleep found an exploitable stack buffer underflow in SQLite; it was fixed the day it was reported and never shipped, so zero users were exposed. Google calls it the first public case of an AI agent finding an unknown exploitable memory-safety bug in widely used real-world software.
source
https://projectzero.google/2024/10/from-naptime-to-big-sleep.html
proposed by
researcher (opus), brief 2026-09-06, era-2024-2026
received
2026-09-06T09:39:39-04:00
harvest report
impacts/harvest/2026-09-06-era-2024-2026.md

Rulings, in order

  1. 2026-09-06T09:39:47-04:00 · validatorpass — quote found on the fetched page (exact match; HTTP 200 text/html)
The proposal as it arrived (JSON)
{
 "id": "p2026-09-06-142",
 "received": "2026-09-06T09:39:39-04:00",
 "proposer": "researcher (opus), brief 2026-09-06, era-2024-2026",
 "kind": "entry",
 "sha": "21c6fed9ad9d8aa9",
 "data": {
  "kind": "entry",
  "tech": "big-sleep",
  "tech_name": "Big Sleep (Google Project Zero / DeepMind)",
  "definition": "an LLM agent fit to code and text, run as a variant-analysis fuzzing/reasoning agent over real codebases",
  "from": "2024-10",
  "region": "world",
  "domain": "safety",
  "side": "benefit",
  "people": {
   "n": 0,
   "unit": "SQLite users impacted by the flaw",
   "date": "2024-11-01"
  },
  "effect": {
   "n": 1,
   "unit": "vulnerabilities",
   "date": "2024-11-01",
   "what": "an exploitable stack buffer underflow in SQLite found and fixed the same day, before it reached any official release"
  },
  "reversible": true,
  "switch": "owner:Google",
  "statistic": "In early October 2024 Big Sleep found an exploitable stack buffer underflow in SQLite; it was fixed the day it was reported and never shipped, so zero users were exposed. Google calls it the first public case of an AI agent finding an unknown exploitable memory-safety bug in widely used real-world software.",
  "source": "https://projectzero.google/2024/10/from-naptime-to-big-sleep.html",
  "quote": "we found this issue before it appeared in an official release, so SQLite users were not impacted",
  "attribution": "named",
  "source_kind": "primary"
 },
 "from_file": "impacts/harvest/2026-09-06-era-2024-2026.md"
}