oss-fuzz-gen

Why we included this project

Teams that ship C, C++, Java, or Python libraries often treat writing fuzz targets as a slow, manual chore that few people have time to do well. This framework from Google's OSS-Fuzz team automates that work: it asks a range of LLMs to generate fuzz targets for real projects, runs them through the OSS-Fuzz platform, and grades each one against the human-written fuzz targets already in OSS-Fuzz, looking at whether they compile, whether they crash, and what they add to coverage. The result is a repeatable way to find out which model and prompt strategy actually produce useful harnesses, backed by experiment reports rather than anecdotes. It has already surfaced dozens of real bugs, including an out-of-bounds read in OpenSSL that became CVE-2024-9143, so security engineers get concrete evidence that LLM-generated fuzzing finds genuine issues, not just coverage noise. It is a research-oriented tool with experiment-style reporting rather than a turnkey scanner, so expect to run it as a batch harness.