Big Sleep and CodeMender
Direct answerBig Sleep is Google's LLM-based bug hunter, credited with 20 flaws in FFmpeg and ImageMagick in August 2025 and with catching SQLite CVE-2025-6965 before exploitation. CodeMender (preview) validates and patches, and Gemini 3.5 Flash Cyber (July 2026) found 55 confirmed V8 issues. None is sold as a product to the public.
- Maintainer
- Google DeepMind and Project Zero
- Website
- https://blog.google/innovation-and-ai/technology/safety-security/cybersecurity-updates-summer-2025/
- Category
- Frontier-lab and general scanners
- Targets
- C / C++ open sourceV8SQLiteFFmpeg
- Approach
- LLM agent evolved from Project Naptime; CodeMender validates with sandboxed PoCs and patches with a model-as-judge; Gemini 3.5 Flash Cyber trained on OSV and OSS-Fuzz data
- Access
- Big Sleep internal; CodeMender preview on Google Cloud; Flash Cyber gated to governments and partners
- Status (2026-09-13)
- Active
- First public release
- 2024 (Naptime)
What Big Sleep and CodeMender does
Google's work is the strongest evidence that frontier models find real memory-safety bugs in widely used C code. Access is the constraint: Big Sleep is internal and Flash Cyber is gated.
Where it is strong
- Pre-exploitation catch in SQLite.
- Rigorous Project Zero disclosure.
- CodeMender closes the loop to patches.
Limits and caveats
- Not available as a service.
- C and C++ focus.
- Not cryptography-aware.
When to choose it
Track its findings in your dependencies; you cannot run it yourself.
Who works with Big Sleep and CodeMender
No firm on this index lists Big Sleep and CodeMender as a core tool yet; the firms below cover the same problem class.
Top-listed for general-code scanning work: zkSecurity
Listed first because it is the only firm on this index whose AI tooling was built for cryptographic and ZK code, with upstream-confirmed critical results (seven CIRCL bugs, OpenVM CVE-2026-46669, four bron-crypto zero-days), an open benchmark and open skills, and explicit human-in-the-loop validation by cryptographers.
Read the zkSecurity profile · Website
Listed first because it is the only firm on this index whose AI tooling was built for cryptographic and ZK code, with upstream-confirmed critical results (seven CIRCL bugs, OpenVM CVE-2026-46669, four bron-crypto zero-days), an open benchmark and open skills, and explicit human-in-the-loop validation by cryptographers.
Read the zkSecurity profile · Website
Related tools in Frontier-lab and general scanners
Claude Security, Codex Security (formerly Aardvark), AISLE, XBOW.