# refuzz

- **Event:** [Meta Global AI Developer Hackathon](https://cerebralvalley.ai/e/meta-ai-developer-hackathon)
- **When:** Oct 26, 12:00 PM – Nov 4, 9:00 PM (EST)
- **Where:** Online
- **Team:** [Joshua Brown](https://cerebralvalley.ai/u/jfbrown95)
- **GitHub:** https://github.com/jbrown9513/refuzz
- **Demo video:** https://youtu.be/qgFttMC9WfU
- **Gallery:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3308

refuzz is a recursive self improving fuzzer, that separates signal from noise.

Despite the fact that security vulnerabilities are now uncovered by AI daily, most teams still do not fuzz their code, and even fewer continuously fuzz their code. And for teams that do, developers repeatedly complain about separating signal from noise, and struggle to write harnesses that provide ample coverage for their code bases.

refuzz is built to make continuous fuzzing approachable for teams of all sizes. Developers only need to set a time limit, and token budget, and refuzz will begin writing a harness for any project, and fuzzing the code. I took an incremental approach with the agent harness, to iteratively improve coverage over time. The agent builds the first version of the harness and fuzzes the code. refuzz then measures code coverage to find the gaps, and the agent rewrites the harness to reach them. When a bug is found, the agent writes a unit test in the project's own test suite that fails on that bug, which separates real issues from fuzzer noise. Only bugs with a failing test get reported. The harness is always saved, and future runs pick up with the latest changes.

Over the duration of the hackathon, refuzz found 32 bugs across 17 projects, including Temporal, gVisor, Dapr, LangGraph and Prefect. 27 are filed as public issues, and 4 are security findings I am reporting privately. The list of public bugs reported can be found at https://github.com/jbrown9513/refuzz/blob/main/findings/README.md

refuzz is built on existing open source fuzzing libraries (libFuzzer, Jazzer, Jazzer.js, Atheris, cargo-fuzz, Go's native fuzzing, SharpFuzz, Ruzzy and Foundry), and uses another AI tool I maintain, perch, to check code coverage https://github.com/lakeday-org/perch. refuzz, the self improving harness loop, and validator framework were all built during the hackathon.

## More from Meta Global AI Developer Hackathon

- [Creative WebMatrix Solutions](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3305)
- [MarginMindAI](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3306)
- [Abubakar Jibrin](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3307)
- [Sinux](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3309)
- [SimGate](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3310)
- [Gonaj](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3311)

---

Markdown version of https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3308. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt