Microsoft Researchers Use AI to Find Memory Safety Flaws in Rust's Standard Library

Microsoft's FORGE Lab has reported several memory safety issues in the standard library of the Rust programming language (known as std and core). Some of the cases mean that code written entirely in safe Rust can still trigger undefined behaviour, which is the kind of problem the language is designed to prevent. The team found the issues using Hyenas, the research version of an AI-powered vulnerability-scanning system codenamed MDASH.

The researchers say the findings fall into three recurring patterns of misplaced trust in unsafe code: trusting code not to panic, trusting user-provided implementations to be correct, and trusting the underlying system. Rust's type system and ownership model rule out whole classes of memory errors, but much of the standard library relies on unsafe code beneath its safe interfaces. When that code breaks its safety contract, even safe Rust can hit behaviour the language is meant to stop.

The work matters because Rust is spreading widely. Microsoft has made it a Tier-1 internal language, and GitHub, Bun, Android, the Linux kernel and Cloudflare are moving code to it. Much of that software depends on core and std, so bugs there can have consequences well beyond where they start. The team reported the bugs to the Rust issue tracker and says Rust's safety model still matters even though its memory safety is not perfect.