Google's Project Zero reported on October 27 that BigSleep found 45 actionable vulnerabilities in V8, Chrome's JavaScript engine, against Fuzzilli's 37 during April through September 2026. The AI agent's narrow lead leaves a reason to keep fuzzing: each system found bugs the other missed.
The study excludes duplicates and requires a fix commit for an actionable report. These are Google's results. We did not rerun either system.
Two ways to search for failures
Fuzzilli's documentation describes a fuzzer that mutates programs in its own intermediate language, FuzzIL, then translates them into JavaScript for execution. Coverage feedback helps it retain interesting inputs. A minimizer reduces crashing programs, making the failure easier to investigate. This is a purpose-built testing system, with engine patches and an instrumented build required for setup.
BigSleep takes a different starting point. Project Zero's earlier account of its design describes giving the agent commit messages and code changes, then asking it to investigate related flaws. That work began with variant analysis: searching for another instance of a previously fixed bug. The approach gives the model a concrete lead, and its investigation includes producing a testcase that demonstrates the failure.
Why the overlap figures differ
In production, the V8 study found roughly 25% overlap. A separate experiment let BigSleep attempt each of 112 historical Fuzzilli bugs 25 times, rediscovering about 62%. Those figures answer different questions. Once a production bug is fixed, the other system loses its chance to rediscover it. The historical experiment also restricts eligible builds and runtime flags.
Cost per bug remains unresolved in the comparison. For teams weighing an AI auditor, the next evidence to watch is whether it finds additional actionable bugs at an acceptable cost on their own code. A higher total alone doesn't establish that an existing fuzzer can be retired.