AI-Powered Fuzzing: Breaking the Bug Hunting Barrier

Google describes leveraging LLMs to automatically generate fuzz targets within OSS-Fuzz, increasing code coverage across open-source projects by 1.5–31% (e.g., tinyxml2 from 38% to 69%) and rediscovering OpenSSL CVE-2022-3602 in previously unfuzzed code. They plan to open source their evaluation framework, fully integrate continuous LLM-generated fuzzing into OSS-Fuzz, extend support beyond C/C++ to languages like Python and Java, and automate project onboarding to scale vulnerability detection for 1,000+ projects.