Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines

Project Zero compared Fuzzilli, a generative JavaScript engine fuzzer, and BigSleep, an LLM-based bug finding system, on Chrome's V8 engine, finding that in the six months from April to September 2026 BigSleep reported 45 actionable vulnerabilities versus Fuzzilli's 37, with roughly 25% overlap in production and about 60% in dedicated re-discovery experiments. The post notes that bugs hard for a fuzzer to find also tend to be hard for an agent, that overlap was smaller for JIT compiler bugs, and that fuzzing and LLMs remain complementary approaches. It recommends vendors perform both fuzzing and agentic analysis of their code to maximize vulnerabilities reported before they impact users.