Google Open Source Security Team

Google reports that AI-generated and AI-enhanced fuzz targets in OSS-Fuzz found 26 new vulnerabilities in projects that already had extensive fuzzing, including CVE-2024-9143 in OpenSSL. The LLM workflow drafts targets, fixes compilation errors, fixes runtime issues and triages crashes, and gained coverage in 272 C/C++ projects.

Google's open source security team reports an experiment connecting OSS-Fuzz to an LLM that writes new fuzz targets for under-fuzzed code and revises them when they fail to compile. Google reports coverage gains of 1.5% to 31% across sample projects, and that an LLM-generated target rediscovered an already-known OpenSSL vulnerability in code that previously lacked fuzzing coverage.