LLM agent builds full zlib fuzz lab in a day
Trail of Bits reports that GPT-5.5-Cyber assembled a full fuzzing campaign against zlib in under a day, complete with sanitiser builds, variant flags and a dozen C/C++ harnesses. It prioritised reachable, high-impact bugs and left noise on the floor, signalling a real shift in the effort needed to launch bespoke fuzzing.
A new field report from Trail of Bits lands a clear punch: a frontier Large Language Model (LLM) can now stand up a credible fuzzing campaign against a battle-tested target in a single working day. Pointed at zlib under the Patch the Planet collaboration with OpenAI, GPT-5.5-Cyber didn’t linger on source review. It built tooling and went hunting.
How it worked
The agent was steered with a persistent goal via Trail of Bits’ Codex setup, then it made the key choice that separates hobby noise from useful signal: dynamic testing over static navel-gazing. It produced AddressSanitizer (ASan) and UndefinedBehaviorSanitizer (UBSan) builds so memory mistakes would shout. It repurposed existing edge-case tests as a seed corpus. It wrote C and C++ harnesses across roughly a dozen entrypoints: inflate, inflateBack, uncompress2, gzFile, MiniZip, puff, blast, infback9, gzjoin, gzappend and several contrib stream wrappers. It also compiled with variant flags such as INFLATE_STRICT, BUILDFIXED and PKZIP_BUG_WORKAROUND to expose code paths the default build hides.
This is not the tired “throw random bytes at gz*” harness you have seen in many OSS-Fuzz baselines. The strongest path here constructed valid gz* states that only emerge under operating system backpressure, then exercised them. That is the subtle, time-consuming part human specialists usually sweat over: reach the weird-but-real state, then push until it breaks.
What broke and what did not
Findings are under coordinated disclosure, but the report calls out something more interesting than any single crash: reporting discipline. Early in the run, the agent hit a null callback crash in inflateBack. It was real, but required a contrived caller state that is extraordinarily unlikely in practice. The agent logged it as unreachable and moved on, focusing on higher-impact issues backed by sanitizer output. Weaker models tend to escalate every segfault; this one filtered.
That filter matters because the moat around bespoke fuzzing has all but drained. The setup tax that used to take a skilled researcher weeks now compresses to a day. That multiplies the throughput of capable auditors, and it raises the floor for low-skill attackers who can supervise an agent and let it grind.
There is a policy wrinkle hidden in the technique: when models can autonomously string together harnesses, variant builds and stateful scenarios, the volume and cadence of credible bug reports will rise. Maintainers already operate under tight time and attention budgets. Coordinated disclosure and patch pipelines will feel the strain. The open question is not whether these agents can do the work. It is how we pace and govern the reporting firehose so fixes land before adversaries rerun the same goals.
