Microsoft FORGE Lab finds memory-safety bugs in Rust core and standard libraries

Microsoft's FORGE Lab researchers say they found memory-safety bugs in the core and std libraries of the Rust programming language. In some cases, they say, ordinary safe Rust code can trigger undefined behavior, meaning the program's behavior is no longer guaranteed. ^[1]

The team used Hyenas, FORGE's frontier research version of the tool codenamed MDASH, which relies on agentic AI tools. Microsoft says the work covered three recurring patterns in which unsafe code places too much trust in its callers, and discusses what they reveal about Rust's safety guarantees. ^[1]