Microsoft's AI Bug Hunters Found Safe Rust Code That Can Still Break Rust's Safety Promise

Microsoft's FORGE Lab published research on November 9 describing memory-safety bugs in Rust's standard library — including cases where code written entirely in safe Rust can trigger undefined behavior. That cuts against the language's core promise, which is precisely why the findings are worth attention: much of Rust's std and core is built from small unsafe blocks wrapped inside safe APIs, and when that underlying code breaks its safety contract, the safe API built on top of it inherits the hole.

Some of the bugs were found with Hyenas, FORGE's frontier research version of codename MDASH, Microsoft's AI-powered vulnerability-scanning system. The MDASH architecture orchestrates more than 100 specialized agents that scan code, validate findings, argue with each other about whether a finding is genuine, and attempt proof-of-concept reproduction before a human reviewer sees anything. Microsoft's researchers then reproduced the bugs, assessed impact, and worked with Rust maintainers to report and fix them.

The post organizes the findings into three recurring patterns of misplaced trust in unsafe code: trusting code not to panic, trusting user-provided implementations to be correct, and trusting the underlying system. Each is a subtle contract violation — the kind of bug that static analysis routinely misses and that even experienced systems programmers argue about.

The stakes come from Rust's growing footprint. Microsoft has made Rust a Tier-1 internal language alongside C++, C# and TypeScript; GitHub rewrote its Copilot agent runtime in Rust; and Bun, Android, the Linux kernel and Cloudflare are all moving critical code to it. Microsoft estimates billions of people interact with Rust-based software daily, usually without knowing it. A soundness bug in std or core propagates far beyond the file where it lives.

The bugs were reported to the Rust issue tracker, and Microsoft credits the maintainers with fast triage and response. Two of the team's reported issues were still open at publication, and the post asks readers to comment only with genuinely new information. The broader point Microsoft draws is that Rust's memory-safety guarantees still matter even though they are not perfect — the rich type system and ownership model rule out whole classes of bugs that other languages accept as normal.

As with all of Microsoft's MDASH-family reporting, the benchmark claims are self-reported and independently unverified. But the concrete artifacts here — real issues in the Rust standard library, filed publicly and argued in the open — are checkable by anyone, which makes this one of the more verifiable entries in the fast-growing genre of AI-found vulnerabilities.