“We believe this is the first public example of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software.”
Big Sleep found a stack buffer underflow in SQLite, where seriesBestIndex mishandled the -1 sentinel for ROWID. SQLite fixed it the same day, before any release shipped it. OSS-Fuzz never had a shot because its harness isn’t built with the generate_series extension. Google’s AI won a race the fuzzer wasn’t entered in.