Microsoft's AI Bug Hunter Finds 11-Year-Old Memory-Safety Flaw in Rust's Standard Library

Microsoft's FORGE Lab used Hyenas, its AI-powered vulnerability-scanning system, to uncover a memory-safety bug in Rust's standard library that had gone undetected for nearly 11 years. The flaw involves calling process::exit from a child thread, which can remove the main thread's alternate signal stack and turn an intended stack-overflow handler into a segmentation fault. Two of the findings affect stable Rust, including a separate issue that could let applications access freed memory, though Microsoft judged practical exploitation unlikely.

Why it matters: It shows agentic AI tools finding long-hidden undefined-behavior bugs in widely used code, which matters for teams that rely on Rust or are considering AI-assisted security scanning.