Google's Big Sleep agent reviewed recent SQLite commits starting from a patched bug and found an exploitable flaw, which was fixed before release.
Google's Big Sleep agent reviewed recent SQLite commits starting from a patched bug and found an exploitable flaw, which was fixed before release.
A Gemini 1.5 Pro agent ran in Project Zero's Naptime framework, which gives it a code browser, debugger, reporter tool and a sandbox for Python scripts. Researchers gave it a previously fixed SQLite bug, plus recent commit messages and diffs, and asked it to look for unresolved similar issues. It linked the old bug to other code, wrote a test case, triggered a crash, and produced a root-cause analysis.
It found a stack buffer underflow in seriesBestIndex, and SQLite fixed it the same day, before any release. Fuzzing for 150 CPU hours failed to rediscover it. The team calls Big Sleep highly experimental.
The bug was in a development version only. The researchers think a target-specific fuzzer would likely be at least as effective as the agent today.
In this repo [path or URL], review the commits from the last [time period or number], starting with the fix for [known patched bug or commit]. Look for similar flaws that the fix may have missed, especially [bug class, e.g. memory safety]. Write a report listing each suspect commit, why it looks vulnerable, and how you'd confirm it. Don't modify the code or disclose anything publicly.
Make pulls contracts from Gmail, Gemini extracts the term and notice period, and a Sheets register emails the owner 60, 30 and 7 days before each deadline.
A self-hosted n8n job reads your calendar, unread email and Notion tasks at 7am and sends one short brief of what matters today.
An n8n and Gemini agent receives patient chat messages, keeps context, uses clinic info from Google Sheets and responds to enquiries.