Find security flaws in open-source software
Google's Big Sleep agent reported about 20 security flaws in open-source software, following its SQLite find.
What they did
Big Sleep, built by Google DeepMind and Project Zero, was pointed at widely used open-source projects. It found and reported 20 previously unknown vulnerabilities, mostly in FFmpeg and ImageMagick. The article gives no detail on the agent's workflow or on how much human review was involved. It does describe the earlier SQLite case, where the agent traced the root cause of a flaw that Google's threat intelligence team had only seen signs of being exploited.
How it went
20 flaws were reported, and their details are withheld under standard disclosure procedures. The article says nothing on severity or fix status for these 20. The earlier SQLite bug (CVE-2025-6965) was rated 7.2 on CVSS.
Worth knowing
The specifics of the 20 flaws are not public yet, so you can't check them. The article also doesn't say how many reports were valid or how much human triage was needed.
Labels
It found and reported 20 previously unknown vulnerabilities, mostly in FFmpeg and ImageMagick.
the agent traced the root cause of a flaw that Google's threat intelligence team had only seen signs of being exploited.
the agent traced the root cause of a flaw
Google's Big Sleep agent reported about 20 security flaws in open-source software, following its SQLite find.
The article gives no detail on the agent's workflow or on how much human review was involved.
The “Material” label failed its quality check and is not used for selection.
Details
- Agents
- Gemini
- Source
- other
- Source date
- undated
- Accounts
- 1
- In registry since
- Oct 12, 2026