Google's open source security team reports an experiment connecting OSS-Fuzz to an LLM that writes new fuzz targets for under-fuzzed code and revises them when they fail to compile. Google reports coverage gains of 1.5% to 31% across sample projects, and that an LLM-generated target rediscovered an already-known OpenSSL vulnerability in code that previously lacked fuzzing coverage.
Why it matters
It is an early documented use of LLMs to automate a defensive testing step that maintainers usually do by hand.
Key facts
As stated in the sources, with where to find them.
- Sample projects gained between 1.5% and 31% code coverage from LLM-generated fuzz targets; tinyxml2 went from 38% to 69% line coverage.Section 'Hey LLM, fuzz this project for me'
- In OpenSSL, an LLM-generated target rediscovered CVE-2022-3602 in code without prior fuzzing coverage; Google notes this was not a new vulnerability.Same section
- OSS-Fuzz covers around 30% of an open source project's code on average, per the post.Section 'LLM-aided fuzzing'
Findings that cite this record
No tracked finding cites this record yet.
Key questions this bears on
- Is AI shifting the balance between finding and fixing vulnerabilities?Discovery is ahead. AI finds real vulnerabilities faster than they are fixed, and simple checks overstate how often AI patches work.