DARPA Built a Report Card for AI That Fixes Hackable Code
Most hacked software runs on decades-old code. This grades the AI trying to fix it.
Memory-safety vulnerabilities remain a persistent security risk in critical software, much of which is written in memory-unsafe languages like C and C++. DARPA's Translating All C to Rust (TRACTOR) program aims to develop scalable techniques for translating large C codebases into safe, performant, and maintainable Rust. MIT Lincoln Laboratory serves as the program's independent test and evaluation organization and has built a standardized benchmark for systematically assessing C-to-Rust translation tools. The result is a publicly available report describing the TRACTOR benchmark — progressively challenging test batteries and larger milestone projects — plus evaluation infrastructure and metrics for assessing correctness, safety, idiomaticity, and performance. The benchmark and its evaluation infrastructure are publicly available to support broader development and evaluation of C-to-Rust translation technologies.
- Old C and C++ code causes a large share of serious security bugs, and there's too much of it to rewrite by hand.
- DARPA's TRACTOR program wants AI to convert that code into Rust, a language built to block those bugs.
- MIT Lincoln Laboratory's public benchmark scores translators on whether the new code works, is safe, reads naturally, and runs fast.
Why It Matters
Fewer memory bugs means fewer hacked banks, breached hospitals, and leaked personal data down the road.