AI Hackers Are Finding Real Zero-Days On Their Own Now. Here’s Proof

For years, “AI hacker” was a movie trope. Then, in quick succession, AI agents started finding real, previously unknown security flaws in software millions of people rely on. Not toy puzzles, not planted bugs alone, but genuine vulnerabilities, reported and patched.

Here is what has actually happened, and why it matters for anyone who builds or uses software.

The first big one: Big Sleep finds a SQLite bug

In November 2024, Google’s Project Zero and Google DeepMind announced that their AI agent, Big Sleep, had found an exploitable stack buffer underflow in SQLite, one of the most widely deployed pieces of software in the world. It runs inside phones, browsers and countless apps.

How it worked:

• The researchers gave the agent recent changes to the SQLite codebase and asked it to look for related issues, a technique called variant analysis.
• The agent explored the code, wrote a test input, ran it in a debugger, triggered a crash and produced a root-cause analysis.
• Google reported the bug in early October 2024, and SQLite’s developers fixed it the same day. Because it was in development code, it never reached an official release.

Google said it believed this was the first public example of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software. According to SecurityWeek, the team then tried to find the same bug with traditional fuzzing and did not find it after 150 CPU-hours.

The team was also careful not to overhype it: they wrote that, at the time, a target-specific fuzzer would likely be at least as effective at finding vulnerabilities. It was a proof of concept, not a replacement for existing tools.

Then a whole competition of AI hackers

The bigger milestone came in August 2025 at DEF CON, where DARPA announced the results of its two-year AI Cyber Challenge (AIxCC). Teams built fully autonomous “cyber reasoning systems” that had to find and patch vulnerabilities in real open-source software with no human help during the competition.

According to DARPA’s results:

• Systems analyzed more than 54 million lines of code.
• They discovered 54 of 63 synthetic vulnerabilities planted by organizers (86%) and patched 43 of them.
• Along the way they found 18 real, non-synthetic vulnerabilities that nobody had planted, six in C codebases and 12 in Java, which are being responsibly disclosed to maintainers.
• Teams submitted patches in an average of 45 minutes and spent about $152 per competition task.
• Performance jumped from the 2024 semifinals, where teams found 37% of synthetic vulnerabilities and patched 25% of those found.

Team Atlanta, made up of experts from Georgia Tech, Samsung Research, KAIST and POSTECH, won the $4 million top prize. Trail of Bits took second ($3 million) and Theori third ($1.5 million). DARPA said the systems would be released as open source so defenders could use them.

Why this is a big deal for defense

Most software is built on open-source components maintained by small teams or volunteers who do not have security budgets. Autonomous systems that can find and fix bugs for about the cost of a nice dinner per task could change that math:

1. Scale. Agents can review far more code than human security teams ever could.
2. Speed. Finding and patching in under an hour shrinks the window attackers have.
3. Cost. Cheap automated audits make security accessible to projects that never had it.
4. Fixes, not just alerts. Generating patches, not just bug reports, reduces the burden on overworked maintainers.

The uncomfortable flip side

Every capability here is dual-use. A system that can find a vulnerability to patch it can find one to exploit it. Security researchers have warned that AI could lower the skill barrier for attackers and speed up the time from a bug’s disclosure to working exploits.

AI agents are also a new attack surface themselves. Agents that read untrusted content, like web pages, emails, documents or code comments, can be manipulated through prompt injection. Developer Simon Willison’s “lethal trifecta” is a good mental model: an agent with access to private data, exposure to untrusted content and the ability to send data out can be tricked into leaking that data.

What builders should do now

• Use AI to audit your own code before someone else does. Ask your coding agent to hunt for security issues, not just features.
• Keep dependencies updated. As AI finds more bugs upstream, patch cadence matters more.
• Don’t give agents the lethal trifecta. Separate tools that read untrusted content from tools that can send data out.
• Keep humans in the loop for anything an agent does with credentials, payments or production systems.

The bottom line

AI security agents crossed from demo to reality: a real pre-release bug in SQLite in 2024, and 18 real-world vulnerabilities from fully autonomous systems in DARPA’s 2025 finals. Defenders have a powerful new tool. So, eventually, will attackers. The race now is to put these systems to work on the world’s open-source code faster than anyone can turn them against it.

Sources

• Google Project Zero, “From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code”, 2024
• SecurityWeek, “Google Says Its AI Found SQLite Vulnerability That Fuzzing Missed”, Nov. 2024
• DARPA, “AI Cyber Challenge marks pivotal inflection point for cyber defense”, Aug. 8, 2025
• AI Cyber Challenge official site
• Simon Willison, “The lethal trifecta for AI agents”, June 16, 2025