Google’s AI-powered bug hunter has announced its first batch of discoveries: 20 security vulnerabilities in popular open-source software. This milestone shows that these tools are beginning to deliver real results, even if they still require human oversight.
Article Contents:
- “Big Sleep” makes its first catch
- Humans are still in the loop
- A new frontier in automated vulnerability discovery
- Promise and peril: AI hallucinations
- A “legitimate” project
- Conclusion: The dawn of a new era for bug hunting
- Frequently Asked Questions
“Big Sleep” makes its first catch
Heather Adkins, Vice President of Security at Google, announced on Monday that the large language model-based vulnerability researcher, “Big Sleep,” has found and reported 20 flaws in popular open-source software. Adkins stated that “Big Sleep,” developed by the company’s AI division DeepMind and its elite hacker team Project Zero, reported its very first vulnerabilities, mostly in open-source software such as the audio and video library FFmpeg and the image editing suite ImageMagick.
Humans are still in the loop
Since the vulnerabilities have not yet been patched, Google did not provide details regarding their impact or severity. However, the fact that “Big Sleep” found these vulnerabilities is significant because it shows these tools are starting to produce real results. Nevertheless, a human is still involved in the process. A Google spokesperson said: “To ensure high-quality and actionable reports, we have a human expert in the loop prior to reporting, but every vulnerability was found and reproduced by the AI agent without human intervention.”
A new frontier in automated vulnerability discovery
Royal Hansen, Vice President of Engineering at Google, wrote on X that the findings demonstrate “a new frontier in automated vulnerability discovery.” Tools powered by large language models that can search for and find vulnerabilities are now a reality. Aside from “Big Sleep,” other tools like RunSybil and XBOW also exist.
Promise and peril: AI hallucinations
There is, of course, plenty of promise with these tools, but there are also significant drawbacks. Several people overseeing various software projects have complained about vulnerability reports that are actually hallucinations, with some describing them as “AI nonsense.” Vlad Ionescu, co-founder of RunSybil, said: “This is the problem people face, which is that we get a lot of things that look like gold, but are actually just trash.”
A “legitimate” project
Despite the challenges, Ionescu considers Google’s “Big Sleep” project to be “legitimate” because it has “good design, and the people behind it know what they are doing, as Project Zero has expertise in finding bugs and DeepMind has the necessary computing power.” This combination of human expertise and computing power is what may set Google’s efforts apart from others.
Conclusion: The dawn of a new era for bug hunting
The achievement of “Big Sleep” represents a major step forward in cybersecurity. It demonstrates that the power of artificial intelligence can be harnessed for defensive purposes, helping to secure the software we all rely on. While human oversight is still needed to filter out noise and verify results, the ability to automate the most time-consuming part of vulnerability discovery promises a safer internet for everyone.
Frequently Asked Questions
What is “Big Sleep”?
It is an artificial intelligence system (agent) developed by Google DeepMind and Project Zero, designed to search for security vulnerabilities in software and report them automatically.
Does the AI work entirely on its own?
The AI finds and reproduces vulnerabilities on its own, but a human expert still reviews the findings before they are formally reported to ensure the quality and accuracy of the reports.
What is the problem with AI “hallucinations” in this field?
The problem is that AI tools may report non-existent vulnerabilities (hallucinations), wasting the time of project maintainers who have to verify these false reports.