Definition
Fuzzing is Fuzzing is a software testing technique that feeds a program huge numbers of random or mutated inputs to make it crash, so hidden bugs and security flaws show up before attackers find them.
Fuzzing is automated bug hunting by brute force. A tool called a fuzzer generates inputs, such as malformed files, odd network messages or strange strings, and throws them at a program over and over. If the program crashes, hangs or leaks memory, the fuzzer saves the exact input that caused it so a developer can reproduce the problem.
Think of it as a toddler with a keyboard. Nobody would write a test that mashes every key in a strange order, but a fuzzer does it millions of times an hour.
A basic fuzzer produces random bytes. Modern fuzzers are smarter. They watch which parts of the code each input reaches, keep the inputs that reach new code, and mutate those to dig deeper. This is called coverage-guided fuzzing.
To fuzz a library, a developer usually writes a small wrapper called a fuzz target or entry point. It takes a blob of bytes from the fuzzer and hands it to the function being tested, such as an image decoder or a file parser. The fuzzer does the rest.
Many open-source projects run fuzzers continuously. Google's OSS-Fuzz service, for example, runs fuzz targets for large numbers of open-source libraries and reports the crashes it finds.
Most serious security holes start as a program mishandling input it did not expect. Fuzzing finds those cases without anyone having to imagine them first. That makes it one of the cheapest ways to find memory-safety bugs in code that parses untrusted data.
It has limits. Fuzzing can show that a bug exists, but it cannot show that none do. A bug that needs one rare, very specific input may never be hit, however long the fuzzer runs. Fuzzers also tell you a crash happened, not whether it is exploitable.
AI models can now write fuzz targets, read crash reports and suggest patches, which speeds up the slow parts of the loop. They are also used to find bugs directly, the way a human security researcher would. Fuzzing pairs naturally with formal verification, which tries to prove a program cannot crash on any input in a defined range. Fuzzing samples the input space. Verification covers it.
For a team using agentic coding tools, fuzz targets are also a useful safety net, because they test the code an agent wrote against inputs nobody thought to try. The same idea sits behind penetration testing, where the goal is to break a system on purpose before someone else does.
Fuzzing is automated testing that sends a program large numbers of random or mutated inputs to trigger crashes and expose bugs or security flaws.
No. Fuzzing can find bugs, but it cannot prove none remain, because it only tries a sample of possible inputs.
Anthropic and Theorem say Claude wrote machine-checked proofs that 239 fuzz entry points across 123 open-source libraries never crash on inputs under 64 MB, finding hundreds of bugs on the way. AI is finally doing the slow, boring half of security.