As cited
Copy frozen at (site build).
vulnerabilities
Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines
Google's Project Zero compared Fuzzilli, a traditional JavaScript engine fuzzer, and BigSleep, an artificial intelligence (AI) based bug-finding system, both running on Chrome's V8 engine over six months. BigSleep discovered 45 vulnerabilities versus Fuzzilli's 37, with roughly 25% overlap in production and approximately 60% overlap in controlled experiments. Both approaches identified distinct bug categories: AI excelled at bugs requiring complex logical reasoning and specific edge-case values, while fuzzing found bugs arising from non-local interactions and compiler optimizations that are difficult to spot through code review alone.
Why it matters: Security teams and vendors should maintain both fuzzing and AI-based code analysis in their vulnerability discovery pipelines, as each method catches distinct classes of bugs that the other misses, and stopping either approach would allow real vulnerabilities to reach production.
- Source published
- First seen by Cybersecurity Tracker