Project Zero compared two automated tools used by Google to identify vulnerabilities in the V8 JavaScript engine: the generative fuzzer Fuzzilli and the LLM-based agent system BigSleep. The analysis covered a six-month period from April to September 2026.
During this timeframe, BigSleep identified 45 vulnerabilities, while Fuzzilli found 37. These figures represent actionable vulnerabilities that were not marked as duplicates or WAI (works as intended) and were linked to at least one fix commit.
The overlap between the two systems is approximately 25% based on bug tracker data. Additional experiments conducted by the team to assess theoretical overlap on vulnerabilities discovered since 2023 suggest a higher intersection rate of about 60%.
Fuzzilli operates continuously across multiple instances, while BigSleep runs once per day, reviewing new commits and generating proof-of-concept test cases. Both systems utilize Clusterfuzz for basic sorting and bug reporting in the Chrome tracker.
The researchers concluded that while LLMs have demonstrated a significant ability to find vulnerabilities in a short time, fuzzing and agent-based analysis currently complement each other. They recommend that software developers employ both methods to improve security.
