Historical clarification, October 4, 2026. Google’s report was published on November 1, 2024, not November 5. Big Sleep, an AI agent, found a SQLite vulnerability. The team believed this was the first public example of an agent finding a previously unknown, exploitable memory-safety issue in widely used software. That claim does not cover every kind of AI-discovered bug.
Google’s Project Zero and DeepMind developed Big Sleep together. In the reported experiment, Gemini 1.5 Pro examined commit messages and code changes for related unfixed bugs. This was experimental variant analysis. The authors said a fuzzer tailored to its target would likely be at least as effective.
The team reported the stack buffer underflow in early October 2024; SQLite’s developers fixed it that day, before an official release. The report says SQLite users were unaffected. It describes memory corruption that was likely exploitable under certain build conditions, without demonstrating arbitrary code execution. This update corrects historical reporting; no independent vulnerability test was performed.
Sources
The Kingy Brief
Get The Kingy Brief.
AI changes, original tests and one practical thing to try. Fridays at 09:00 Vancouver time.
Free · Double opt-in · Unsubscribe anytime
Signup help and newsletter schedule
Signup form provided by Beehiiv. After submitting, check your inbox for "Confirm your subscription to The Kingy Brief" and open its confirmation link. Check Spam or Promotions if you cannot find it.
Fridays at 09:00 Vancouver time: source-checked AI changes, original tests and one practical thing to try. The weekly restart begins October 9, 2026. We skip a week when there is not enough verified material. Free. Unsubscribe anytime.