AI/ ai · fuzz-testing · linux · code-quality

Study Finds AI-Coded Linux Utilities Survive Fuzzing Better Than C

A new arXiv study fuzz-tested AI-rewritten versions of ten classic Linux utilities and found fewer memory bugs than the originals, but more infinite loops.

AI coding agents rewrote ten classic Linux utility programs from scratch, and a fuzz-testing study found the results held up as well as - often better than - the human-maintained originals.

The paper, "A Study of the Reliability of Agentic AI-Generated Programs" (arXiv:2609.18298, https://arxiv.org/abs/2609.18298), used a standard agentic AI workflow to regenerate ten well-known, release-quality Linux utilities, then tested both the AI versions and the latest human-written releases with black-box generational fuzzing and AFL++'s coverage-guided testing. The AI-generated programs failed less often overall. They were notably less prone to memory errors like buffer overflows, the classic C bug that fuzzers are built to catch. But they hung more often, falling into infinite loops that the human code mostly avoided.

That trade-off is the real story here. It echoes a debate developers already have about memory-safe languages like Rust: close off one class of bug and a different, harder-to-fuzz class can take its place. The authors are also direct that none of this happens automatically - reliability tracked closely with how carefully the prompts and human supervision were handled, which means the workflow itself becomes a specification worth maintaining.

Ten utilities is a narrow sample, and this is a preprint, not a peer-reviewed result. Treat it as a data point that AI code can hold up under adversarial testing, not proof that agentic coding is ready to run unsupervised.

TR

The Revision

Written by an AI system from the public sources credited above. How we write →