Microsoft Describes Rust Library Bugs Hyenas Helped Find

Hyenas and Rust library bugs are the subject of new research from Microsoft FORGE Lab, published by Microsoft on November 9, 2026. Researchers say the Hyenas agentic tool, a research version codenamed MDASH, helped find some bugs related to type and memory safety in Rust’s standard libraries. People then analyzed, reproduced, assessed, and reported them to Rust maintainers.

Rust is designed to limit common memory-safety bugs. However, the research notes that under certain circumstances, incorrect implementations of internal unsafe code can violate the guarantees programmers expect from safe Rust code. The findings themselves do not mean that every Rust application is remotely exploitable.

Hyenas and Rust library bugs: three recurring patterns

Microsoft describes three categories of problematic assumptions in the core libraries:

• code behavior when a panic occurs,
• assumptions about user-provided trait implementations,
• interaction with global operating-system or C-library state.

According to Microsoft, Hyenas helped search for some such cases. Human researchers further investigated the relevant findings and reported them to Rust project maintainers.

Some fixes are already in the main branch

Several of the described issues have already received fixes in Rust’s main development branch. The bug in MapWindows::clone was closed on June 2, 2026. According to the relevant report, it concerned a nightly API.

Another change concerns Utf8Pattern::StringPattern. The fix requiring UTF-8 was merged on May 16, 2026.

The Rust project also closed an issue involving an alternate signal stack that could arise when calling process::exit from a subthread. The fix was merged and the issue closed on August 14, 2026. Microsoft says that, in this case, practical exploitation for code execution was unlikely under the conditions examined.

CommandExt::exec remained open

When verifying the status of the reports, an issue in CommandExt::exec remained open. It involves writing to a global environment pointer while the code holds only a read lock. The issue is marked P-high priority and classified as a reliability bug.

According to the information in the issue, the Rust Security Response Team did not consider this case grounds for a security advisory. The available materials also do not indicate confirmed active exploitation of any of the described issues in real-world applications.

What developers should monitor

For teams using Rust, it is important to monitor toolchain releases and changelogs that confirm which stable versions include the individual fixes. The available materials do not independently confirm that all the mentioned changes are already part of specific stable releases.

Developers should also monitor issue #156951 for CommandExt::exec, the related proposed fix, and any clarifications from the Rust Security Response Team. Independent reproductions showing the scope of the impact in specific programs will also be relevant.

Microsoft presents the result as a practical example of using agentic tools in security research. The published cases also show that expert verification, reproduction, and upstream fixes remain essential for findings of this kind.

Verified and updated: November 10, 2026 06:24