OSS-Fuzz Gen

OSS-Fuzz Gen is a Google project that uses large language models to automatically write fuzz targets for open-source software, extending the reach of the OSS-Fuzz continuous fuzzing service. The open-source project has around 1,400 stars on GitHub and remains in active development in 2026.

Overview

Fuzzing finds bugs and security vulnerabilities by feeding programs mutated inputs, but it depends on hand-written fuzz targets that many projects never get around to creating. OSS-Fuzz Gen attacks that bottleneck: it prompts LLMs with a project’s source code and APIs to generate candidate fuzz targets, then compiles, runs, and measures them, keeping the ones that build and measurably improve coverage. The repository includes the generation pipeline, an agent-based approach for iteratively fixing targets that fail to build or run, and a benchmark framework for evaluating how well different models perform at the task across real C and C++ projects. Results from this research have fed back into OSS-Fuzz itself, where LLM-generated targets have increased code coverage and surfaced real vulnerabilities in widely used libraries. Released under the Apache-2.0 license, the project sits at the intersection of AI for code and practical software security.

Key Features

• LLM-generated fuzz targets for C and C++ projects in OSS-Fuzz
• Automatic build, run, and coverage measurement to validate generated targets
• Agent loop that repairs targets failing to compile or execute
• Benchmark harness for comparing models at fuzz-target generation
• Demonstrated coverage gains and real vulnerability discovery in OSS projects
• Apache-2.0 licensed and developed by the OSS-Fuzz team at Google

💳 Pricing

Free. OSS-Fuzz Gen is fully open source under the Apache-2.0 license; you supply any LLM access used for generation.

Who Is It For

Security researchers, OSS-Fuzz maintainers, and AI-for-code researchers interested in using LLMs to scale fuzzing and vulnerability discovery.