Microsoft researchers say AI scanning found memory-safety bugs in Rust’s standard library

Microsoft’s FORGE Lab says its AI-powered Hyenas scanner found soundness bugs in Rust’s standard library that could let entirely safe Rust code trigger undefined behaviour. The findings put a useful pressure test on Rust’s safety promise: the language can only be as safe as the trusted code beneath it.

Microsoft AI Watch analysis

What happened

In a FORGE Lab report, the researchers describe three recurring patterns involving unsafe code: trusting code not to panic, trusting user-provided implementations to be correct, and trusting the underlying system. The report says Hyenas was used to identify the issues.

The supplied report does not name affected components, describe fixes or establish that the bugs have been exploited. Its claim is about vulnerabilities found in the standard library, not proof that ordinary Rust applications are broadly unsafe.

Key findings

• Safe Rust can still encounter undefined behaviour
  The lab says the bugs allow code written entirely in safe Rust to trigger undefined behaviour through flaws in the standard library.
• The trust boundary is the recurring theme
  The researchers group the patterns around assumptions made by unsafe code about panics, user implementations and the underlying system.

Why it matters

Rust’s appeal is that its type and ownership rules prevent many memory errors in safe code. But standard libraries necessarily contain carefully controlled unsafe code, and defects at that boundary can undermine the guarantees users rely on. That makes the report relevant to Rust developers and to anyone assessing how AI tools might help find difficult flaws in foundational software.

Our read

This is a meaningful research claim, not a reason to abandon Rust or assume every project is affected. The important next step is specific: which library components are involved, what versions are affected, and what fixes or mitigations follow. AI-assisted discovery gets its real value when findings can be reproduced, triaged and repaired, rather than merely given a dramatic headline.

What to watch

• Whether the lab publishes affected components and reproducible details.
• Whether Rust maintainers confirm the findings and issue fixes or guidance.
• How the researchers describe Hyenas’ contribution and the limits of the scan.

Discussion spark: Should unsafe code in foundational libraries face a separate formal audit bar, or are existing review practices enough?

not affiliated with or endorsed by Microsoft