Google reports that AI-generated and AI-enhanced fuzz targets in OSS-Fuzz found 26 new vulnerabilities in projects that already had extensive fuzzing, including CVE-2024-9143 in OpenSSL. The LLM workflow drafts targets, fixes compilation errors, fixes runtime issues and triages crashes, and gained coverage in 272 C/C++ projects.
Why it matters
It is a vendor-documented case of LLM-driven tooling finding a CVE in critical, heavily tested software.
Key facts
As stated in the sources, with where to find them.
- 26 new vulnerabilities were reported, each found with AI-generated or enhanced fuzz targets.Opening paragraphs
- Coverage gains in 272 C/C++ projects (up from 160), adding over 370,000 lines of new coverage; the largest single-project gain went from 77 to 5,434 lines.Section 'New results'
- CVE-2024-9143 in OpenSSL was reported on September 16 and a fix was published October 16; Google estimates it had likely been present for two decades.Section 'New results'
- The OSS-Fuzz LLM framework was open-sourced in January 2024.Section 'The story so far'
Findings that cite this record
Key questions this bears on
- Is AI shifting the balance between finding and fixing vulnerabilities?Discovery is ahead. AI finds real vulnerabilities faster than they are fixed, and simple checks overstate how often AI patches work.
Sources
Related records
Aug 16, 2023
Mar 9, 2026
Jan 27, 2026