LLMs now out-find fuzzers in V8, while most CIOs cannot see their own dependencies
Victoria Shinder1 min readTwo pieces published the same week describe opposite ends of the vulnerability pipeline.
At the finding end, Google Project Zero compared its two automated bug finders on Chrome's V8 JavaScript engine (https://projectzero.google/2026/10/fuzzing-v-AI.html). Over April to September 2026, BigSleep, an LLM-based agentic system that reviews new commits once a day and writes proof-of-concept tests, reported more vulnerabilities than Fuzzilli, the generative JavaScript fuzzer that runs continuously: 45 against 37, with 25% overlap in the specific bugs. Because that method tends to underestimate overlap, Project Zero ran dedicated experiments on vulnerabilities since 2023 and estimated it at roughly 60%. Either way, a substantial share was found by only one approach, and the team recommends vendors run both fuzzing and agentic analysis.
At the fixing end, Red Hat surveyed 1,400 CIOs in 14 EMEA countries (https://www.redhat.com/en/blog/securing-enterprise-software-supply-chain-ai-era). 76% said they typically deploy critical security fixes within 24 hours of a patch, yet only 32.9% maintain a complete, continuously updated view of their open source supply chain including nested dependencies, and 43.0% see primary components but not the libraries buried inside third-party applications. On AI governance, 86.7% felt confident, while only 39.6% expressed complete confidence in their data visibility.
What it means
Put together, the numbers point to where the bottleneck is moving. If machines find more vulnerabilities faster, more patches arrive — and a fast patching team only helps for components the organisation knows it runs. Two thirds of the surveyed CIOs cannot say that for nested dependencies. The Red Hat figures are self-reported by a vendor that sells into that gap; the Project Zero counts come from a public bug tracker and say themselves that overlap is uncertain.