Google's AI Agent Big Sleep Discovers Critical SQLite Vulnerability

Google revealed on July 15 that its AI security agent Big Sleep discovered a critical vulnerability in SQLite (CVE-2025-6965) just before attackers could exploit it. This marks the first time an AI system has directly prevented a live cyberattack.

Key Details:

• Vulnerability: SQL injection flaw allowing integer overflow attacks
• Threat: Active exploitation attempts were underway
• AI Agent: Big Sleep (developed by Google DeepMind/Project Zero)
• Impact: Prevented potential data breaches across millions of SQLite deployments

"Our AI agent Big Sleep helped us detect and foil an imminent exploit. We believe this is a first for an AI agent"
— Sundar Pichai (@sundarpichai)

Technical Breakdown:

The vulnerability (described in SQLite docs) allowed attackers to:

1. Inject malicious SQL statements
2. Trigger integer overflows
3. Read beyond array boundaries

Expanded AI Security Features:

Google also announced:

• Agentic Timesketch: AI-powered forensic investigation automation
• Proactive Threat Prediction: Combining threat intelligence with AI analysis

"We have seen real leaps in AI's capabilities to create durable cybersecurity" - Google stated in its blog post.

This breakthrough demonstrates AI's growing role in proactive cyber defense, shifting from vulnerability detection to active threat prevention.