Google has announced significant achievements with its AI-powered fuzzing tool, OSS-Fuzz, which has discovered 26 vulnerabilities in open-source projects, including a notable security flaw in OpenSSL.

Key Points:
– The OpenSSL vulnerability (CVE-2024-9143) is rated medium-severity with a CVSS score of 4.3
– The bug could potentially cause application crashes or enable remote code execution
– The vulnerability remained undetected for approximately 20 years
– Patches are available in updated versions of OpenSSL

AI Enhancement Success:
– Integration of Large Language Models (LLMs) into OSS-Fuzz in August 2023
– Improved code coverage across 272 C/C++ projects
– Added 370,000+ lines of new code coverage
– Successfully detected issues that traditional human-written fuzz targets missed

Google’s Security Initiatives:
1. Implementation of the Big Sleep LLM framework
2. Transition to memory-safe languages like Rust
3. Enhancement of C++ security through:
– Safe Buffers implementation
– Hardened libc++ with minimal performance impact (0.30%)

This development represents a significant advancement in automated vulnerability detection, demonstrating the effective combination of AI and security testing tools to identify long-standing security issues in critical software infrastructure.