Fuzzers
Also written: fuzz testing
Tools that automatically supply invalid, unexpected, or random data as input to a computer program to find software defects.
Fuzzers are automated tools that test software by feeding it a large amount of random or unexpected data. The goal is to find bugs or security vulnerabilities that might not be discovered through normal testing.
Imagine you have a program that processes user input. A fuzzer would repeatedly send this program malformed or unusual inputs to see if it crashes or behaves unexpectedly. This helps developers find and fix problems before users encounter them.
Fuzzers, or fuzz testing tools, automatically generate and supply malformed, unexpected, or random data as inputs to a program. They aim to discover software defects, such as crashes, memory leaks, or security vulnerabilities, by triggering edge cases and error conditions that might be missed by manual testing or traditional test suites.
Fuzzing techniques include mutation-based fuzzing (modifying valid inputs) and generation-based fuzzing (creating inputs from scratch based on a model of the input format). The effectiveness of fuzzing depends on the coverage achieved and the ability to detect program state changes indicating a failure.
Anthropic is using fuzz testing to find security vulnerabilities in open-source software. This highlights the growing use of AI-powered tools to improve software security and reliability, a key concern for AI labs developing complex systems.
- An opt-in vulnerability-finding service for open-source softwareAnthropic · Anthropic Research ·
- Quoting Boris ChernyAnthropic · Simon Willison ·
- Anthropic Claude
- Anthropic uses fuzz testing as part of its service to find security holes in open-source software and sets a high bar for AI-generated code using automated checks.
- Static Analysis
- Tools that examine code without executing it to find potential
- Dynamic Analysis
- Tools that analyze a program while it is running, often to det
- Unit Testing
- A method where individual components or units of code are tested i
The term 'fuzzing' was coined by Barton Miller at the University of Wisconsin in 1988. His research involved sending random data to programs to observe their behavior and identify crashes. Source ↗
While direct fuzzing tools are for developers, you can observe similar principles by deliberately entering unexpected or nonsensical data into chatbot interfaces. For example, try asking a chatbot a question in a completely made-up language or providing extremely long, repetitive text to see how it handles the input without crashing.
The Playbook: reusable how-tos, prompts, configs and tips pulled out of the news.
- PromptRole-play a student struggling with math for AI tutor simulationSimulate a student's math struggles and uncertainty for AI tutor evaluation. · 5 min
- TemplateReusable workflow templates for healthcare teamsTeams can create and share templates for common workflows like documentation or prior authorizations. · 15 min
- TemplateTemplate for building an AI tool tailored to your workA structured approach to defining and building a custom AI tool for specific business needs. · 15 min
- TemplateEvals CSV prompt list for agent skillsA CSV file template for listing prompts used in evaluating agent skills. · 20 min
- HeuristicDouble coding agent task completion with docs linksProviding coding agents with a documentation link significantly increases their task completion rate. · 2 min
Questions people ask
- How does fuzzing find bugs?
- Fuzzing finds bugs by repeatedly sending unexpected or malformed inputs to a program. When the program crashes or behaves incorrectly, it indicates a potential defect that the fuzzer has uncovered.
- Is fuzzing only for security?
- No, fuzzing is used to find various software defects, including crashes and incorrect behavior, not just security vulnerabilities. However, many security flaws are found through fuzzing.
First seen on Subvolts Sep 11, 2026. Updated Oct 15, 2026. Written by an AI model from the items above and reviewed against them weekly; report an error.