Google has launched Project Naptime aimed at using AI for vulnerability research.

Google has introduced Project Naptime, a new framework aimed at enhancing vulnerability research using large language models (LLMs). According to Google Project Zero researchers Sergei Glazunov and Mark Brand, Naptime revolves around an AI agent interacting with a target codebase. This agent is equipped with specialized tools that simulate the workflow of human security researchers.

The initiative allows humans to take breaks while it aids in vulnerability research and automates variant analysis. Its core objective is leveraging LLMs’ advancements in code comprehension and reasoning to replicate human behavior in identifying and demonstrating security vulnerabilities.

Key components include a Code Browser for navigating codebases, a Python tool for sandboxed script execution (fuzzing), a Debugger for observing program behavior with different inputs, and a Reporter for task progress monitoring.

Google highlights that Naptime is model-agnostic and backend-agnostic, demonstrating improved performance in detecting buffer overflow and advanced memory corruption flaws based on CYBERSECEVAL 2 benchmarks. These benchmarks, released by Meta researchers, evaluate LLM security risks.

In Google’s tests to reproduce and exploit flaws, Naptime achieved significantly higher scores in vulnerability categories compared to previous benchmarks. The framework enables LLMs to conduct vulnerability research in a manner that closely mimics the iterative, hypothesis-driven approach of human experts, ensuring accurate and reproducible results.