Google Open-Sources AI Security Patches After Big Sleep Vulnerability Discoveries

What Google Announced

In a February 12, 2026 Google Security Blog post, Google said it is releasing patches to improve AI-powered vulnerability detection in core open source security tooling. The company connected the release to real incident history from its AI agent Big Sleep, which identified an OpenSSL vulnerability now tracked as CVE-2025-6965. Google said this issue was patched upstream.

Google framed this as a practical milestone: AI security systems producing findings that translate into real fixes in widely used software components.

Linked Case History

The same post referenced an earlier January 2026 case where Big Sleep identified a vulnerability in NVIDIA Triton. Google said the issue was patched and assigned CVE-2025-23319. By pairing two concrete examples, Google is signaling that the workflow is repeatable rather than a one-off lab result.

• Patches are being shared with OSS-Fuzz and Open Source Vulnerabilities
• The effort is positioned within the broader open source security ecosystem
• Google also highlighted collaboration with OpenSSF and the Rust Foundation

Why It Matters For AI/IT Teams

For engineering organizations, the important shift is not simply that AI found bugs. It is that model-assisted discovery is being tied to measurable security outcomes: upstream patches and CVE records. That changes how teams can evaluate AI tooling in production pipelines.

In practice, this points to a hybrid operating model for 2026 security programs. AI-enhanced detection can expand coverage and accelerate triage, while established secure development controls still handle validation, remediation, and release governance. The Google examples suggest that the strongest near-term value comes from integrating AI into existing vulnerability management systems, not replacing them.

For open source maintainers and enterprise consumers alike, shared improvements to OSS-Fuzz and Open Source Vulnerabilities may also reduce duplicated effort across ecosystems. As more maintainers adopt these enhancements, the impact could extend beyond Google’s own environments to a broader supply-chain security baseline.

Source: Google Security Blog