Rust Researcher Builds AI Pipeline to Test 900 Vulnerability Hypotheses Across Crates and Linux Kernel

Sergey Gordeychik, co-founder of CyberOK and SCADA StrangeLove, set out to evaluate remaining classes of bugs in Rust programs after selecting the language for a high-speed packet-processing project. Because the language promises memory safety through ownership, borrowing, and lifetimes, he wanted to understand what errors still occur at crate boundaries and in application logic that the compiler cannot enforce.

He created the Damn Vulnerable Rust Application containing classic issues such as access-control bypasses, OS command injection, SSRF, path traversal, secret leakage, and double-free conditions. A threat model listing concrete prohibitions guided subsequent testing. Initial runs of conventional security tools produced limited results, prompting Gordeychik to integrate LLM-based agents.

The resulting rust-in-peace pipeline runs three independent analysis passes plus a dedicated SAST stage. One pass follows an explicit threat model, another performs blind exploration, and the third replays historical CVE patterns and prior findings. Surviving hypotheses are validated through API tests, fuzzing, or instrumented execution. Failed proof-of-concept attempts feed lessons back into the harness via the LESSONS.md file, which agents consult on later runs.

Early experiments on the vulnerable application achieved 9-of-9 detection once hints were removed and Rust-specific questions added. When applied to real crates, the system surfaced a plausible but ultimately false scenario in x509-parser involving an empty RSA value; the dangerous path was blocked earlier inside asn1-rs. After requiring explicit dependency citations, the pipeline produced actionable results in lopdf and other format parsers.

Across a sample of 50 candidates the three passes generated 80 hits that reduced to 20 confirmed findings after manual triage: 15 with working PoCs and five verified through source analysis. Nine findings appeared in all three passes. The research also contributed a patch to the Linux kernel and was presented at the ZeroNights conference.

Static-analysis coverage was measured with Semgrep and CodeQL rule sets; both showed limited reach against the parser-logic bugs that interested the researcher. The final architecture therefore retains single-pass discoveries rather than relying on majority voting, because eight of the twenty findings would have been lost under a consensus rule.