Summary
Google’s Big Sleep team reported that its LLM-assisted vulnerability research agent found an exploitable stack buffer underflow in SQLite during a real-world variant-analysis experiment. The issue was reported to SQLite in early October 2024 and fixed the same day.
The important launch signal is not only that an AI agent found a real bug. It is that the target was a mature, heavily tested open-source project and the issue was found before it reached users through an official release.
Why it belongs in the index
This entry is the public starting point for the bugflation record. Project Zero described it as the first public example of an AI agent finding a previously unknown, exploitable memory-safety issue in widely used real-world software.
We do not count it as a CVE because there is no CVE. We do count it as a high-confidence AI-attributed finding because the primary source is the research team that built and operated the system, and the report includes enough detail to connect the finding to SQLite’s patch process.
Editorial note
The finding also sets a useful constraint on the thesis. Big Sleep did not magically search the entire software universe. The team framed a variant analysis task using recent SQLite commits, then gave the agent source access, debug tooling, and a concrete research objective.
That is still operationally meaningful. The defender advantage comes from making that kind of guided review cheap enough to run continuously.
References
Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.