Google’s AI-powered bug hunter, Big Sleep, developed by DeepMind and Project Zero, has identified 20 security vulnerabilities in open-source software, marking its initial public reporting of flaws.
Today as part of our commitment to transparency in this space, we are proud to announce that we have reported the first 20 vulnerabilities discovered using our AI-based “Big Sleep” system powered by Gemini — https://t.co/0sgPlazqaq
— Heather Adkins – Ꜻ – Spes consilium non est (@argvee) August 4, 2025
Heather Adkins, Google’s vice president of security, disclosed on Monday that Big Sleep, an LLM-based vulnerability researcher, detected these flaws across various popular open-source software applications. The identified vulnerabilities primarily impact systems such as FFmpeg, an audio and video library, and ImageMagick, an image-editing suite. Details regarding the specific impact or severity of these vulnerabilities have not been released due to Google’s standard protocol of withholding information until fixes are implemented.
Kimberly Samra, a Google spokesperson, clarified the process involved in these discoveries. Samra stated, “To ensure high quality and actionable reports, we have a human expert in the loop before reporting, but each vulnerability was found and reproduced by the AI agent without human intervention.” This procedure confirms that while human verification occurs, the initial detection and reproduction of the vulnerability are performed autonomously by the AI agent.
Royal Hansen, Google’s vice president of engineering, characterized these findings as demonstrating “a new frontier in automated vulnerability discovery” in a post on X. Big Sleep is not the only LLM-powered tool designed for vulnerability detection; other notable examples include RunSybil and XBOW.
XBOW has gained attention for reaching the top position on a U.S. leaderboard within the bug bounty platform HackerOne. Similar to Big Sleep, many of these AI-powered bug hunters incorporate a human verification step to confirm the legitimacy of detected vulnerabilities. Vlad Ionescu, co-founder and chief technology officer at RunSybil, a startup specializing in AI-powered bug hunters, described Big Sleep as a “legit” project. He attributed this assessment to its “good design, people behind it know what they’re doing, Project Zero has the bug finding experience and DeepMind has the firepower and tokens to throw at it.”
While the potential of these AI tools for identifying security flaws is evident, there are also noted drawbacks. Several maintainers of various software projects have reported receiving bug reports that are later identified as hallucinations, drawing parallels to “AI slop” in the context of bug bounties. Ionescu previously commented on this issue, stating, “That’s the problem people are running into, is we’re getting a lot of stuff that looks like gold, but it’s actually just crap.”
Featured image credit
FAQs
Frequently Asked Questions
What is a Premium Domain Name? A premium domain name is the digital equivalent of prime real estate. It’s a short, catchy, and highly desirable web address that can significantly boost your brand's impact. These exclusive domains are already owned but available for purchase, offering you a shortcut to a powerful online presence. Why Choose a Premium Domain? Instant Brand Boost: Premium domains are like instant credibility boosters. They command attention, inspire trust, and make your business look established from day one. Memorable and Magnetic: Short, sweet, and unforgettable - these domains stick in people's minds. This means more visitors, better recall, and ultimately, more business. Outshine the Competition: In a crowded digital world, a premium domain is your secret weapon. Stand out, get noticed, and leave a lasting impression. Smart Investment: Premium domains often appreciate in value, just like a well-chosen piece of property. Own a piece of the digital world that could pay dividends. What Sets Premium Domains Apart? Unlike ordinary domain names, premium domains are carefully crafted to be exceptional. They are shorter, more memorable, and often include valuable keywords. Plus, they often come with a built-in advantage: established online presence and search engine visibility. How Much Does a Premium Domain Cost? The price tag for a premium domain depends on its desirability. While they cost more than standard domains, the investment can be game-changing. Think of it as an upfront cost for a long-term return. BrandBucket offers transparent pricing, so you know exactly what you're getting. Premium Domains: Worth the Investment? Absolutely! A premium domain is more than just a website address; it's a strategic asset. By choosing the right premium domain, you're investing in your brand's future and setting yourself up for long-term success. What Are the Costs Associated with a Premium Domain? While the initial purchase price of a premium domain is typically higher than a standard domain, the annual renewal fees are usually the same. Additionally, you may incur transfer fees if you decide to sell or move the domain to a different registrar. Can I Negotiate the Price of a Premium Domain?
In some cases, it may be possible to negotiate the price of a premium domain. However, the success of negotiations depends on factors such as the domain's demand, the seller's willingness to negotiate, and the overall market conditions. At BrandBucket, we offer transparent, upfront pricing, but if you see a name that you like and wish to discuss price, please reach out to our sales team.
How Do I Transfer a Premium Domain?
Transferring a premium domain involves a few steps, including unlocking the domain, obtaining an authorization code from the current registrar, and initiating the transfer with the new registrar. Many domain name marketplaces, including BrandBucket, offer assistance with the transfer process.
