Google’s Big Sleep AI Strikes Hard: Uncovers Critical SQLite Flaw Before Hackers Could Exploit It

Google's AI agent Big Sleep recently discovered a critical security flaw in SQLite, an open-source database engine widely used across software applications123. This vulnerability, officially tracked as CVE-2025-6965, is a stack buffer underflow involving improper handling of negative indices, which could allow attackers to perform arbitrary read or write operations outside the intended memory bounds, potentially leading to crashes or arbitrary code execution19.

What makes this discovery significant is that the flaw was previously unknown and known only to threat actors — it was on the verge of being exploited in the wild25. Big Sleep, developed collaboratively by Google DeepMind and Google Project Zero, combined large language model (LLM) technology with threat intelligence to proactively detect the vulnerability before it caused harm, enabling a swift patch25.

Big Sleep's approach goes beyond traditional methods like fuzzing. It uses advanced AI techniques such as variant analysis, root-cause analysis, and code pattern recognition to autonomously scan large codebases for subtle and complex vulnerabilities that conventional tools can miss49. It analyzes changes like commit diffs and simulates real-world conditions to identify exploitable bugs9.

Google described this as a milestone in cybersecurity: the first time an AI agent has not only found a previously unknown critical vulnerability but has also directly intervened to thwart an imminent cyberattack2. CEO Sundar Pichai noted this achievement as a first step toward AI-driven defense becoming a standard, with Big Sleep helping to scale human security expertise and accelerate vulnerability research25.

Beyond this discovery, Google plans to continue expanding AI-powered security tools for both its own products and widely used open-source projects, aiming to shift cybersecurity from reactive patching to proactive threat prediction and prevention5.

In summary:

This breakthrough demonstrates AI’s growing role as a powerful ally in cybersecurity, enhancing defenders' ability to find and mitigate threats more efficiently and safely125.