The Google Open Source Security Team has made significant advancements in automated vulnerability finding using AI-powered fuzzing. Over the past year and a half, they've been working on leveraging large language models (LLMs) to improve fuzzing coverage and find more vulnerabilities automatically. They've been focusing on two major improvements: generating more relevant context in prompts for LLMs and expanding this to simulate a developer's workflow. This has led to the discovery of 26 new vulnerabilities in open source projects on OSS-Fuzz, including a critical vulnerability in OpenSSL (CVE-2024-9143). The team has also been working on automating the manual process of developing a fuzz target, including drafting an initial fuzz target, fixing compilation issues, running the fuzz target to see how it performs, and triaging any crashes. They've also been collaborating with researchers to fully automate the workflow by having the LLM generate a suggested patch for the vulnerability.