Project Zero

Fuzzilli vs BigSleep: 37 and 45 Vulnerabilities Found in V8 Over Six Months with 25% Overlap

Google's Project Zero compared two automated vulnerability discovery tools targeting the V8 JavaScript engine in Chrome. The generative fuzzer Fuzzilli identified 37 actionable vulnerabilities over six months, while the LLM-based agent BigSleep found 45. Only about 25% of the vulnerabilities overlapped between the two systems. Additional experiments on historical bugs from 2023 onward showed a theoretical overlap of around 60%. The analysis indicates that fuzzing and LLM agents complement each other rather than one replacing the other. Researchers recommend using both approaches together to maximize coverage of complex bugs in well-tested software like V8.

Automated Pentesting and BAS: How AI Systems Like XBOW Outpace Human Researchers in Vulnerability Discovery

The article explores how automated penetration testing and Breach and Attack Simulation tools have evolved to provide continuous validation of security controls beyond annual manual pentests. It explains the distinction between BAS, which tests individual attack techniques against security tools using frameworks like MITRE ATT&CK, and autopentest solutions that build complete attack paths to critical assets. Russian vendor Positive Technologies released PT Dephaze 3.0 in October 2025, incorporating machine learning for controlled internal pentesting and earning the National Runet Award. Globally, AI-driven systems demonstrated superior performance, with XBOW topping HackerOne rankings by discovering over 1,000 vulnerabilities including 54 critical ones in just 90 days. Google’s Big Sleep project, combining DeepMind and Project Zero, identified and helped patch CVE-2025-6965 in SQLite before widespread exploitation. These developments underscore the need to integrate automated validation into vulnerability management processes under the emerging CTEM framework.