Many of the world’s critical IT systems remain riddled with bugs, and AI tools threaten to make it easier than ever to exploit them. But AI could also be part of the solution: A new initiative aims to automatically convert vulnerable code into the security-focused language Rust, which would eliminate the vast majority of known software vulnerabilities.
Rapid advances in AI coding tools have made it easier than ever to tackle software engineering tasks that were previously too expensive or time-consuming to take on. The Institute for Progress think tank launched the Great Refactor initiative to use those tools in order to convert open source software written in C and C++ into Rust. Unlike the former languages, Rust is designed to prevent a dangerous class of bugs known as memory exploits.
Memory safety issues occur when software accesses or manipulates memory in an unintended way. These bugs are prevalent in older languages that provide developers with manual control over memory handling. Most newer languages incorporate guardrails to prevent these kinds of problems, but this typically comes at the cost of lower performance. As a result, memory-unsafe languages like C and C++ are still widely used, and memory-safety exploits still account for an estimated 70 percent of software vulnerabilities.
Rust’s Role in Memory Safety
Rust, which was first released in 2015, is designed to match the performance of C and C++ while introducing memory safety. The language has seen rapid uptake by technology companies eager to harden their code, including Amazon, Google, and Microsoft, but converting older software into Rust is a laborious and expensive process.
The success of the Great Refactor is banking on the idea that AI tools have changed the equation, says project lead Herbie Bradley, a PhD student at the University of Cambridge in the United Kingdom. The initiative proposes setting up a “Focused Research Organization” funded by the U.S. government that will use AI-powered coding tools to convert 100 million lines of code in critical open-source software libraries into Rust by 2030. For an investment of $100 million, Bradley estimates the project could prevent hundreds of cyberattacks with a cumulative cost of roughly $2 billion.
“I am very bullish on the ability of AI to transform how software development is done, and part of that obviously includes the potential to do things basically which would previously have been considered too cost or time prohibitive,” Bradley says. “In five years’ time, if people want a Rust version of any major library…they will be able to make it.”
What makes the approach so attractive, says Bradley, is the potential to resolve a large swathe of vulnerabilities in one shot rather than having to engage in the normal approach of dealing with each bug on a case-by-case basis. This could be particularly attractive for the “long tail” of small open source libraries that are often maintained by a small number of overworked volunteers.
Converting a small C codebase into Rust manually typically requires thousands of hours of human effort by experienced Rust engineers, who are in short supply. But the latest AI coding tools can now reliably carry out translations of programs less than 1,000 lines long with little supervision, Bradley says. With a little oversight, programs containing up to 5,000 lines are within reach. These capabilities are also progressing rapidly, Bradley adds.
A position paper outlining the proposal suggests that a team of less than 50 security engineers, AI researchers, and administrators could make a sizable dent in key open-source libraries on a 3 to 5 year timeline. Initial efforts would be focused on identifying the most important libraries to secure and developing robust tools for validating the security and functionality of AI-translated code.
AI-Powered Rust Translation Tools
The project hopes to piggyback on existing efforts to create AI-powered Rust translation tools, most notably the US Defense Advanced Research Projects Agency’s Translating All C To Rust (TRACTOR) program. The program was launched in 2024 to investigate how emerging generative AI tools could be combined with traditional code analysis to automate Rust translations.
Despite rapid improvements in AI code generation since the launch, program manager Dan Wallach thinks a hybrid approach is still likely to win out. The six teams funded under the program are taking a spectrum of approaches, he says, from relying almost entirely on AI to building primarily classical conversion tools that only outsource parts of the problem to generative models.
“AI seems promising, but also we have decades of research into writing software to analyze other software,” he says. “The whole point of TRACTOR is to explore all the different ways you might mix and match, for lack of a better term, classical computer science with modern AI.”
The teams submitted their first round of results in December, and the program’s evaluation team is currently analyzing their entries. Two of the main criteria they will be judged on are correctness (whether the code does what it’s supposed to) and performance, but a third more subjective measure is perhaps the most important, says Wallach. The teams have been challenged to create “idiomatic” Rust code—code that follows best practices and solves problems in well-established way. In other words, “does the code look the way a skilled Rust programmer would have built it from scratch,” says Wallach.
This will be crucial for ensuring the resulting code is easily maintainable by human engineers, but Josh Triplett, an open source developer who contributes to the Rust project, says this may prove challenging. “If you do AI-translated code, you are likely to end up with code that is difficult for a human to maintain compared to what was manually translated,” he says.
That may not always be a problem, says Triplett, who welcomes any effort to convert more code into Rust. If a project is already using AI to help maintain its code—an increasingly common situation—then using AI to to translate into Rust would be entirely reasonable. But he cautions against teams not already using the technology regularly to turn to it for code conversions. He also thinks more caution is warranted with popular open-source libraries that thousands of other projects rely on.
“Possibly you’d want to take a little more care in the conversion and maybe use AI to help you, but very carefully,” he says. “There will never be a silver bullet for AI being 100 percent robust against doing the wrong thing, whether it is by hallucinating or by not understanding the assignment.”
Another potential challenge, says Jessica Ji, a senior research analyst at Georgetown University’s Center for Security and Emerging Technology, is that while Rust’s popularity is growing, it still has a relatively small developer base. “Assuming everything goes well with the AI translation, the resulting Rust code will need to be maintained and monitored somehow,” she writes in an email to Spectrum. “There are a lot fewer Rust experts out there than C/C++ experts, so the number of expert eyes on the codebase(s) will likely be fewer.”
Challenges in Adopting Rust
Perhaps the biggest barrier, however, will be convincing the U.S. government to fund the project, says Ji, particularly at the scale envisaged. She thinks a more realistic goal might be to solicit funding from the private sector for a proof-of-concept. “I think it’s a good time to pitch a proposal like this because AI companies are particularly incentivized to show off their models’ capabilities,” she says.
Bradley is also thinking along similar lines. While he’s held discussion with representatives of both the U.S. and U.K. governments, he is also exploring whether the project would make more sense as a commercial venture, given that a large amount of the vulnerable code that could benefit from translation to Rust exists in private companies and critical infrastructure providers.
From Your Site Articles
Related Articles Around the Web
