Google’s AI agent ‘Big Sleep’ foils cyberattack before it happens

In what could be a turning point for cybersecurity, Google has announced that its AI agent, Big Sleep, successfully detected and blocked an imminent cyber exploit before it could be deployed. This is a first-of-its-kind milestone in the use of artificial intelligence for active threat prevention.

The announcement came directly from Google CEO Sundar Pichai through his X account.

“New from our security teams: Our AI agent Big Sleep helped us detect and foil an imminent exploit. We believe this is a first for an AI agent, definitely not the last, giving cybersecurity defenders new tools to stop threats before they’re widespread,” he wrote.

From passive detection to proactive defense

Until now, AI has primarily served as a post-breach diagnostic tool, helping analysts identify intrusions after the fact. Big Sleep signals the beginning of a new era where AI agents can detect and disrupt cyberattacks before they even begin.

Cybersecurity experts say this shift could change the game for defenders, enabling faster response times and reducing dependence on human reaction.

About Big Sleep

Big Sleep is an AI agent developed by Google DeepMind in collaboration with Project Zero, Google’s elite vulnerability research team. Its mission: to autonomously identify unknown software vulnerabilities before bad actors can exploit them.

The agent first made headlines in November 2024, when it discovered a previously unknown real-world software flaw.

Since then, Big Sleep has uncovered multiple critical bugs, including a recent zero-day vulnerability in SQLite (CVE-2025-6965) that was known only to cybercriminals. This time, with assistance from Google Threat Intelligence, the AI didn’t just detect the flaw. It anticipated the attack, blocked the exploit path, and neutralized the threat before it could be launched.

How it works

While technical details remain under wraps, Big Sleep operates by continuously scanning codebases, telemetry, and behavioral signals across systems, looking for high-risk anomalies and latent vulnerabilities.

Once a threat vector is detected, it coordinates with human teams to verify and mitigate it, or in some cases, like this one, acts on its own.

The agent is not limited to Google’s internal infrastructure. It is now being deployed across open-source projects and integrated into Google Cloud’s security stack, potentially benefiting millions of users globally.

What's next?

Though Google hasn’t disclosed how long Big Sleep has been active or when it was officially deployed, Pichai hinted that this is just the beginning. More AI-driven agents are expected to be rolled out across Google’s products and made available to enterprise and cloud customers.