Robots Atlas>ROBOTS ATLAS
Tooling

OSS-Fuzz

2016ActivePublished: 2 September 2026Updated: 2 September 2026Published
Key innovation
Made industrial-scale continuous, automated fuzzing free and available to open source projects as a CI-style service, replacing one-off manual testing campaigns.
Category
Tooling
Abstraction level
System
Operation level
ToolingEvaluation (runtime)
Use cases
Finding security vulnerabilities in C/C++ librariesContinuous stability testing of open source projectsFuzzing integrated into CI/CDAutomatic generation of fuzz targets using LLMs (OSS-Fuzz-Gen)Benchmark for AI-generated tests and fuzz harnesses

How it works

Projects integrate via build files (Dockerfile + build.sh) that define how to build fuzz targets. OSS-Fuzz compiles the code with a chosen fuzzing engine (libFuzzer/AFL++/Honggfuzz/Centipede) and sanitizers (address/memory/undefined), then runs them at scale on the distributed ClusterFuzz infrastructure. Detected crashes are deduplicated, minimized and reported to maintainers under a responsible-disclosure process, and fixes are automatically verified. The OSS-Fuzz-Gen extension uses LLMs to generate new fuzz harnesses and benchmarks them against existing ones for compilability, runtime crashes and code coverage.

Problem solved

Critical open source software was fuzzed rarely and ad hoc, so serious vulnerabilities (e.g. Heartbleed) went undetected for long periods. OSS-Fuzz provides continuous, automated fuzzing on Google infrastructure with fast reporting of crashes and regressions to maintainers.

Components

ClusterFuzzDistributed fuzzing execution backend

Scalable backend that runs fuzz targets across many machines, deduplicates and minimizes crashes and manages their lifecycle.

Fuzzing enginesTest input generation

libFuzzer, AFL++, Honggfuzz and Centipede — engines that generate and mutate inputs to trigger crashes.

Official

SanitizersRuntime error detection

AddressSanitizer, MemorySanitizer and UndefinedBehaviorSanitizer detect memory errors and undefined behavior while running fuzz targets.

Official

Build infrastructure (Docker)Reproducible building of fuzz targets

Docker images with build.sh scripts define a reproducible way to compile each project's fuzz targets.

OSS-Fuzz-GenLLM-based fuzz target generation

Framework that uses large language models (Gemini, GPT) to automatically write and benchmark fuzz harnesses for OSS-Fuzz projects.

Official

Evolution

2016
OSS-Fuzz launched
Inflection point

Google launches OSS-Fuzz (announced Dec 1, 2016) after Heartbleed, in cooperation with the Core Infrastructure Initiative.

2023
OSS-Fuzz-Gen released

Google releases OSS-Fuzz-Gen, a framework using LLMs to automatically generate fuzz targets.

2024
CVE-2024-9143 found via AI
Inflection point

LLM-generated targets in OSS-Fuzz-Gen found 30 new bugs, including CVE-2024-9143 in OpenSSL, unreachable by prior hand-written targets.

Hyperparameters (configurable axes)

Fuzzing engineHigh

Engine that generates inputs for the fuzz target.

libFuzzer
AFL++
Honggfuzz
Centipede
SanitizerHigh

Instrumentation that detects runtime errors. Defaults to address and undefined.

addressAddressSanitizer (default)
undefinedUndefinedBehaviorSanitizer (default)
memoryMemorySanitizer (opt-in)
Project languageMedium

Programming language of the fuzzed project.

C/C++
Rust
Go
Python
Java/JVM
JavaScript

Hardware requirements

Primary

Fuzzing is CPU-bound; OSS-Fuzz runs targets on x86_64/i386 clusters without accelerators.