Hunt for unpatched vulnerabilities in SQLite commits
Google's Big Sleep agent reviewed recent SQLite commits starting from a patched bug and found an exploitable flaw, which was fixed before release.
What they did
A Gemini 1.5 Pro agent ran in Project Zero's Naptime framework, which gives it a code browser, debugger, reporter tool and a sandbox for Python scripts. Researchers gave it a previously fixed SQLite bug, plus recent commit messages and diffs, and asked it to look for unresolved similar issues. It linked the old bug to other code, wrote a test case, triggered a crash, and produced a root-cause analysis.
How it went
It found a stack buffer underflow in seriesBestIndex, and SQLite fixed it the same day, before any release. Fuzzing for 150 CPU hours failed to rediscover it. The team calls Big Sleep highly experimental.
Worth knowing
The bug was in a development version only. The researchers think a target-specific fuzzer would likely be at least as effective as the agent today.
Labels
Google's Big Sleep agent reviewed recent SQLite commits starting from a patched bug and found an exploitable flaw, which was fixed before release.
A Gemini 1.5 Pro agent ran in Project Zero's Naptime framework, which gives it a code browser, debugger, reporter tool and a sandbox for Python scripts.
Researchers gave it a previously fixed SQLite bug, plus recent commit messages and diffs, and asked it to look for unresolved similar issues.
It linked the old bug to other code, wrote a test case, triggered a crash, and produced a root-cause analysis.
The “Material” label failed its quality check and is not used for selection.
Details
- Agents
- Gemini
- Source
- other
- Source date
- undated
- Accounts
- 2
- In registry since
- Oct 12, 2026