Scan open-source projects for possible security bugs
Big Sleep found and reported 20 previously unknown issues in widely used open-source projects.
- What they did
- Google DeepMind and Project Zero used Big Sleep, with Gemini, to inspect popular open-source projects for flaws. The agent turned up 20 new vulnerabilities, most of them in FFmpeg and ImageMagick. The writeup does not spell out the workflow or how much human checking was involved.
- How it went
- The 20 findings were reported under standard disclosure rules, so their details are not public yet. The story does not say whether they were all valid, how serious they are, or whether fixes have landed. It does note an earlier SQLite case where the agent tracked down the root cause of a bug that Google’s threat team had seen signs of active exploitation for; that issue was CVE-2025-6965 and scored 7.2 on CVSS.
- Tips
- Because the findings are undisclosed, you cannot verify them yourself right now. If you try this on your own project, keep the agent in a read-only mode and have a person review anything it flags before you report or submit it.
Try it yourself with Gemini
Inspect [open-source repository URL] for likely security flaws in its [language or component]. Look for memory-safety bugs, unsafe parsing, injection paths, and secret exposure. For each suspect issue, record the file path, why it looks risky, and a rough severity guess. Do not edit code, open tickets, or send reports yet. After you finish, stop and ask me to approve any write-up, disclosure, or other irreversible action.
Fill in the [brackets]. Agents can make mistakes, so review anything before it is sent, paid or deleted.
Get 3 agent uses like this every morning
With the day's top AI news. Free, and one click to unsubscribe.
Related agent uses
Use local rules to sort waste from photos
Have Gemini check local recycling rules online, identify items in a photo, and assign each one to compost, recycling, or trash.
Have Gemini write robot control plans from vision and speech
A developer used Gemini to turn camera input and robot tools into Python plans, then drove robot actions with voice commands.
Review recent patches for nearby SQLite flaws
A Gemini agent followed one fixed SQLite bug into surrounding commits and found another memory-safety issue before it shipped.
Run Spot step by step with Gemini
A developer paired Gemini Robotics ER 2 with Boston Dynamics Spot so it could plan, check, and continue multi-step chores.
Test a math agent on hard open questions
DeepMind’s Aletheia, built on Gemini Deep Think, found proofs for four Erdős problems in a large benchmark run.
Use Claude Desktop to pilot a home robot
Tal Raviv linked Claude Desktop to a small robot and let it navigate, observe, and log a patrol with voice feedback.