Google Rewrites C Libraries with AI to Fix Memory Safety

Overview

Google has successfully completed a pilot project demonstrating that large language models can effectively rewrite critical C libraries into the memory-safe language Rust. The initiative, led by engineers Bastian Kersting and Max Hils, focused on migrating giflib, a widely used image processing library, to eliminate a major category of security vulnerabilities.

Memory safety flaws continue to account for approximately 70% of vulnerabilities in C and C++ codebases. By leveraging Gemini, Google’s generative AI model, the team aimed to reduce the attack surface posed by third-party dependencies that often parse untrusted data. The result is a production-ready, ABI-compatible Rust replacement that has already neutralized a recently disclosed zero-day vulnerability.

"Replacing a C library with Rust does not immediately eliminate all unsafe code... We needed to develop specialized building blocks to handle pointer lifecycle management at the interface boundary."

The Challenge of Legacy Code

The security landscape for software engineering is increasingly defined by the speed at which vulnerabilities are discovered and weaponized. As LLM capabilities grow, the interval between a bug being found and an attacker exploiting it continues to shrink. While Google has long advocated for a Safe Coding strategy prioritizing memory-safe languages, the vast ecosystem of existing C/C++ dependencies remains a significant risk.

For this pilot, the team selected giflib as the target. Originally developed by Eric S. Raymond, the library is responsible for handling GIF images and frequently operates on untrusted data in non-sandboxed environments. The codebase presented an ideal complexity profile for the experiment: it consisted of approximately 3,000 lines of code, lacked complex SIMD or assembly optimizations, and maintained a stable structure.

The primary engineering goal was to produce a drop-in replacement that could be deployed across Google’s global infrastructure with zero disruption to dependent services. This required not only functional equivalence but also strict adherence to the original Application Binary Interface (ABI), ensuring that existing C callers could interact with the new Rust implementation without modification.

Methodology: AI-Assisted Rewrites

The translation process from C to Rust was driven by a three-step LLM workflow. This approach moved beyond simple automated translation to include rigorous human-in-the-loop validation and iterative refinement.

One-shot initial rewrite: Given the library's moderate size, the team used Gemini to perform a complete initial translation of the C codebase into Rust. This established the core logic and structure of the new implementation rapidly.
FFI layer iteration: The initial translation revealed defects in memory management, particularly at the Foreign Function Interface (FFI) boundary. The team iteratively prompted the model to refine the C-compatible wrapper layer. Through this process, all remaining unsafe code was subjected to expert review to ensure correctness.
Validation feedback loop: Any behavioral or logic defects uncovered during differential testing were fed back into the model autonomously. This created a continuous improvement cycle where the AI generated targeted fixes for specific edge cases identified by the testing framework.

A critical discovery during this phase was the importance of the social component of security. Technical accuracy alone was insufficient; deploying AI-generated code into critical services required building trust with service owners. This was achieved through a comprehensive validation framework and a clearly defined rollback strategy, ensuring transparency regarding how the generated code matched the original behavior.

Rigorous Validation and Real-World Impact

To achieve the confidence levels necessary for global deployment, Google subjected the Rust rewrite to exhaustive testing protocols that went far beyond standard unit tests. The validation pipeline included mass-scale regression testing, differential fuzzing, and adversarial AI analysis.

The team validated the rewrite against a dataset of over 30 million GIFs, ensuring the new implementation produced results identical to the original C version across a vast set of real-world inputs. Additionally, a differential fuzzer exercised both implementations side-by-side. Over six days of continuous execution, the fuzzer performed more than 200 million iterations without identifying any logic deviations.

Perhaps most remarkably, the validation process employed specialized LLM prompts to conduct "adversarial reviews." These prompts asked other models to identify subtle behavioral differences between the two codebases that traditional testing might miss. This approach not only found an edge case in the LZW decoder but also uncovered a pre-existing out-of-bounds write vulnerability in the original C source, which had been introduced by a legacy Google-internal patch. The Rust rewrite corrected this flaw automatically.

The true efficacy of this approach was proven shortly after the rollout began. A new memory corruption vulnerability, designated CVE-2026-26740, was reported in the original C implementation of giflib. Because Google’s production systems had already migrated to the memory-safe Rust fork, they were inherently immune to the exploit.

"We had effectively neutralized a zero-day vulnerability through a structural architectural change before the CVE was even publicly disclosed."

Interestingly, the engineering team was unaware of the disclosure or the existence of the CVE while working on the project. The migration protected the infrastructure proactively, shielding Google from the immediate threat and providing lasting defense against future memory safety vulnerabilities in the library.

Performance and Architectural Gains

Introducing memory-safe languages often raises concerns regarding performance degradation due to runtime checks, such as bounds checking. However, monitoring across Google’s global image processing services confirmed that the Rust implementation remained performance-neutral compared to the original C code.

The success of this pilot suggests that AI-assisted rewrites are a viable strategy for securing large-scale C/C++ ecosystems. By combining the speed of LLM translation with rigorous differential testing and adversarial validation, organizations can systematically eliminate entire classes of vulnerabilities without sacrificing performance or operational stability. This methodology offers a scalable path forward for modernizing legacy codebases that form the backbone of critical internet infrastructure.