Google’s AI-powered bug hunter has simply reported its first batch of security vulnerabilities.
Heather Adkins, Google’s vice chairman of security, introduced Monday that its LLM-based vulnerability researcher Huge Sleep discovered and reported 20 flaws in varied in style open supply software program.
Adkins mentioned that Huge Sleep, which is developed by the corporate’s AI division DeepMind in addition to its elite crew of hackers Venture Zero, reported its first-ever vulnerabilities, principally in open supply software program equivalent to audio and video library FFmpeg and image-editing suite ImageMagick.
Provided that the vulnerabilities will not be mounted but, we don’t have particulars of their influence or severity, as Google doesn’t but need to present particulars, which is a normal coverage when ready for bugs to be mounted. However the easy proven fact that Huge Sleep discovered these vulnerabilities is important, because it reveals these instruments are beginning to get actual outcomes, even when there was a human concerned on this case.
“To make sure prime quality and actionable studies, now we have a human skilled within the loop earlier than reporting, however every vulnerability was discovered and reproduced by the AI agent with out human intervention,” Google’s spokesperson Kimberly Samra advised information.killnetswitch.
Royal Hansen, Google’s vice chairman of engineering, wrote on X that the findings display “a brand new frontier in automated vulnerability discovery.”
LLM-powered instruments that may search for and discover vulnerabilities are already a actuality. Aside from Huge Sleep, there’s RunSybil and XBOW, amongst others.
Techcrunch occasion
San Francisco
|
October 27-29, 2025
XBOW has garnered headlines after it reached the highest of one of many U.S. leaderboards at bug bounty platform HackerOne. It’s essential to notice that most often, these studies have a human throughout the method to confirm that the AI-powered bug hunter discovered a legit vulnerability, as is the case with Huge Sleep.
Vlad Ionescu, co-founder and chief expertise officer at RunSybil, a startup that develops AI-powered bug hunters, advised information.killnetswitch that Huge Sleep is a “legit” undertaking, on condition that it has “good design, individuals behind it know what they’re doing, Venture Zero has the bug discovering expertise and DeepMind has the firepower and tokens to throw at it.”
There may be clearly quite a lot of promise with these instruments, but in addition important downsides. A number of individuals who preserve totally different software program initiatives have complained of bug studies which are truly hallucinations, with some calling them the bug bounty equal of AI slop.
“That’s the issue individuals are working into, is we’re getting quite a lot of stuff that appears like gold, nevertheless it’s truly simply crap,” Ionescu beforehand advised information.killnetswitch.
