Fuzzing with AI

Overview of the course, learning objectives and syllabus

A map of the fuzzing field: what coverage-guided, property-based, and API fuzzing are, how they differ across three key axes, and which technique fits which target.

The anatomy of a harness: entry point, typed input generation with FuzzedDataProvider, exception handling rules, instrumentation scope, and the state reset requirement. Includes the common patterns that make harnesses ineffective.

Build an Atheris fuzz harness for a JSON payment parser, fix its exception handling so the fuzzer can report findings, and convert the crash into a regression test.

The six property patterns (invariant, round-trip, idempotence, different paths, hard to prove/easy to verify, test oracle) applied to security bugs. Hypothesis strategies, shrinking, and the property-to-Hypothesis translation for each pattern. Includes parser differential attacks as a concrete application of the oracle pattern.

Combining Hypothesis and Atheris to get both coverage guidance and a property oracle. The fuzz_one_input integration, the InMemoryExampleDatabase tradeoff, and the two-step workflow: run the fuzzer to find, switch to plain Hypothesis to shrink.

Apply all six property patterns to a payment threshold function, run Hypothesis to find an int32 overflow the fuzzer cannot surface alone, and write a regression test from the shrunk failing example.

Schema-driven fuzzing with Schemathesis from the simplest parametrize call through custom security checks for information disclosure, broken access control, and schema pattern overrides. Includes stateful multi-step test sequences and an honest account of what schema-driven fuzzing cannot reach.

How to reproduce a fuzzer crash deterministically, reduce it to its minimal form, decide whether it is a security bug, convert it into a regression test, and integrate fuzzing into a CI pipeline.

Use Schemathesis to fuzz a payment processing API, write a custom check to detect information disclosure the default oracle misses, and override schema-driven input generation to expose a ReDoS vulnerability.

Writing prompts that produce usable harnesses from function signatures, docstrings, and existing tests. Three-iteration worked example from minimal context to a coverage-verified harness. Using unit and integration tests as prompt context to generate seeds and exception handling automatically.

Using an LLM to generate semantically meaningful seeds for known formats (JWT, JSON, custom binary), edge-case dictionaries that go beyond hand-written token lists, and measuring coverage impact before committing to a seed set.

Prompting an LLM with function source code to generate candidate security properties, evaluating each property for soundness, and identifying the property categories the model consistently misses without explicit prompting.

Use an AI assistant to generate a fuzz harness, a seed corpus, and property-based tests for the same payment module. Evaluate each output against the module 11 checklist, identify what the AI gets wrong without context, and improve it.

A six-item checklist applied to a single broken AI-generated harness: exception scope, instrumentation scope, target depth, shared state, oracle strength, and I/O in the loop. Before/after coverage comparison showing the measurable impact of each fix.

How OSS-Fuzz-Gen generates and validates harnesses at scale, the published accuracy rates and failure modes, a five-stage automated validation pipeline with working code for each gate, and which parts of the fuzzing workflow still require human judgment.