Review recent patches for nearby SQLite flaws

A Gemini agent followed one fixed SQLite bug into surrounding commits and found another memory-safety issue before it shipped.

Done with Gemini· Advanced

What they did
Researchers used Gemini 1.5 Pro inside Project Zero’s Naptime framework, which provided a code browser, debugger, reporter, and a Python sandbox. They started with one SQLite bug that had already been patched, then gave the agent current commit notes and code changes and asked it to hunt for similar unresolved defects. It tied the original issue to other parts of the codebase, built a test case, reproduced a crash, and wrote up the cause.
How it went
The agent identified a stack buffer underflow in seriesBestIndex. SQLite corrected it the same day, and the problem never reached a release. Later fuzzing for 150 CPU hours did not rediscover the flaw, and the researchers described Big Sleep as highly experimental.
Tips
A good setup is to seed the agent with one confirmed fix and ask it to look for the same pattern elsewhere. For agents doing security work, stop before any external report, submission, or code change until you review the findings.

Try it yourself with Gemini

In [repo path or URL], start from [known fixed bug or patch] and inspect the newer commits around it. Search for places where the same mistake may still be present, especially [bug class or component]. For each candidate, explain the clue that makes it suspicious and how you would test it. Do not edit files or share results outside this workspace. If the next step would change code, send something, delete anything, or submit a report, stop first and ask me to approve it.

Fill in the [brackets]. Agents can make mistakes, so review anything before it is sent, paid or deleted.

Read the original on scworld.com ↗

1 more report of this

Get 3 agent uses like this every morning

With the day's top AI news. Free, and one click to unsubscribe.