From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code
Summary: Google Project Zero and Google DeepMind's Big Sleep agent found an exploitable stack buffer underflow in SQLite, a widely used open source database engine, and reported it to developers in early October, who fixed it the same day before it appeared in an official release. The bug involves a sentinel value of -1 in the index-typed iColumn field, which seriesBestIndex failed to handle, causing a write below the aIdx stack buffer when a query constrains the rowid column; SQLite's existing OSS-Fuzz and project testing infrastructure had not found the issue.
What you should know: The agent found a memory-safety flaw that fuzzing and the project's own testing infrastructure missed, and because it was caught before release, SQLite users were not impacted - the question is whether your own pre-release pipeline has any equivalent way to surface the variants that fuzzing keeps missing.
Read the original at Google Project Zero ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026