OSS-Fuzz
A continuous fuzzing platform for open-source software developed by Google. It integrates libFuzzer with AddressSanitizer to provide automated vulnerability discovery services for open-source projects, running fuzz tests at scale and reporting discovered bugs to maintainers.
Core Facts
Timeline (last 90 days)
Officially, the successful no-crash proofs cover 123 different OSS-Fuzz libraries and cover 239 entry points.
Anthropic used Claude to carry out formal verification on 123 OSS-Fuzz open-source libraries, proving that the code of these libraries contains no paths that cause crashes.
OSS-Fuzz's inclusion criteria require a project to have a clear fuzz target (test entry function) and to be buildable in a form callable by engines such as libFuzzer or AFL.
Anthropic opened the public service OSS Scanner on October 8; its output vulnerability reports are entirely model-generated, with no human review or triage, the service is free and optional, inspired by Google's OSS-Fuzz, and maintainers register by submitting a pull request to anthropics/oss-scanner.
The curl project itself has long used OSS-Fuzz for continuous fuzz testing.
All Facts (8)
Google's OSS-Fuzz project has used AI technology to discover dozens of previously unknown open-source software vulnerabilities.
90%VerifiedGoogle launched the OSS-Fuzz continuous fuzzing platform for open-source software in 2016.
75%UnverifiedOSS-Fuzz迄今已在600余个开源项目中发现超过1万个漏洞
85%UnverifiedOfficially, the successful no-crash proofs cover 123 different OSS-Fuzz libraries and cover 239 entry points.
50%UnverifiedOSS-Fuzz's inclusion criteria require a project to have a clear fuzz target (test entry function) and to be buildable in a form callable by engines such as libFuzzer or AFL.
50%UnverifiedThe curl project itself has long used OSS-Fuzz for continuous fuzz testing.
50%UnverifiedAnthropic used Claude to carry out formal verification on 123 OSS-Fuzz open-source libraries, proving that the code of these libraries contains no paths that cause crashes.
50%UnverifiedAnthropic opened the public service OSS Scanner on October 8; its output vulnerability reports are entirely model-generated, with no human review or triage, the service is free and optional, inspired by Google's OSS-Fuzz, and maintainers register by submitting a pull request to anthropics/oss-scanner.
50%