TLDR: Google’s advanced AI agent, ‘Big Sleep,’ a collaborative effort between DeepMind and Project Zero, has successfully identified 20 new vulnerabilities, primarily within widely used open-source software such as ImageMagick and FFmpeg. This achievement marks a significant advancement in automated cybersecurity and proactive threat detection.
Google has announced a significant breakthrough in cybersecurity with its AI-based system, ‘Big Sleep,’ which has successfully reported its first 20 software vulnerabilities. Developed by Google’s AI division DeepMind in conjunction with its elite security research team, Project Zero, Big Sleep represents a new frontier in automated vulnerability discovery.
Heather Adkins, Vice President of Security at Google, stated that this disclosure is part of the company’s commitment to transparency in the AI space, highlighting the successful identification of these vulnerabilities by the Gemini-powered AI system. Royal Hansen, Vice President of Engineering at Google, further emphasized the impact of these findings, noting that Big Sleep has uncovered flaws in widely used and reviewed software, demonstrating a novel approach to automated security analysis.
The majority of the identified vulnerabilities were found in critical open-source software projects, including the popular image editing suite ImageMagick and the comprehensive audio/video library FFmpeg. This underscores the potential of AI agents to enhance the security posture of the broader open-source ecosystem.
Big Sleep is part of an emerging class of large language model (LLM)-powered tools designed for vulnerability detection and reporting, alongside other notable systems like XBOW and RunSybil. These tools actively search for and pinpoint unknown security weaknesses in software.
This recent announcement builds on previous successes, including an incident in July 2025 where Big Sleep proactively identified and neutralized a critical SQLite vulnerability (CVE-2025-6965). This particular flaw was known to threat actors and was at imminent risk of exploitation. Google considers this a landmark achievement, believing it to be the first instance of an AI agent directly thwarting an attempted exploitation of a vulnerability in the wild, signaling a shift from reactive patching to proactive, intelligence-led defense.
Also Read:
- Leading AI Agents Vulnerable: Security Flaws Exposed in Major Red Teaming Competition
- Cyber Adversaries Leverage AI for Scaled Attacks, Targeting AI Systems Themselves, CrowdStrike Report Reveals
Since its debut in November 2024, Big Sleep has consistently exceeded Google’s expectations by discovering multiple real-world vulnerabilities. The company is now actively deploying Big Sleep to bolster the security of various open-source projects, asserting that AI agents are a ‘game changer’ that can ‘free up security teams to focus on high-complexity threats, dramatically scaling their impact and reach.’
