Researchers from the Google Project Zero and Google DeepMind teams have released a report on the development of the AI system Big Sleep, built on the large language model Gemini 1.5 Pro, designed to identify vulnerabilities in source code. A significant achievement of the project was the discovery, using Big Sleep, of the first exploitable and previously unknown vulnerability in an existing project. The vulnerability was identified through the AI system's analysis of the SQLite database management system's codebase, leading to a buffer underflow issue. The problem was discovered in recently accepted code and was fixed before it made it into the final release of SQLite 3.47.0.
The model can be used as an auxiliary tool in areas where labor-intensive manual reviews are required, as well as for organizing automated checks of new code to identify vulnerabilities at early stages of development (before problematic code reaches final releases). It is expected that the developed AI model will enable the detection of security-related issues in code that are challenging to identify through fuzz testing.
Additionally, it's worth noting the statement from Google's CEO that currently more than a quarter (25%) of all code created within the company is generated using large language models Gemini, after which this code is reviewed and accepted by engineers. It is emphasized that such use of AI has significantly accelerated the product development process.
Source: opennet.ru
