{"resourceId":"arxiv-c-to-rust-fallacy-automatic-refactoring-not-memory-security-20260922","versions":[{"version":"external-a7ba2a26d6635ddae01669cfbf55bb8ee4b8aacb666a1948483b4d024fdd1d2c","resource":{"id":"arxiv-c-to-rust-fallacy-automatic-refactoring-not-memory-security-20260922","title":"Preprint: automated C-to-Rust refactoring tools left original memory-security bugs and introduced new ones on 116 NIST Juliet test programs","organization":"Hung-Mao Chen, Xu He, Bo Lu, Xiaokuan Zhang, Kun Sun (arXiv preprint)","sector":"Academic software-security research","geography":"Not stated on the abstract page; method uses the U.S. NIST Juliet Test Suite","publishedAt":"arXiv, submitted Sept. 22, 2026 (v1)","publicationDate":"2026-09-22","eventDate":null,"sourceName":"arXiv","sourceLabel":"C-to-Rust Fallacy: Automatic Refactoring != Memory Security (arXiv:2609.25682v1)","sourceUrl":"https://arxiv.org/abs/2609.25682v1","evidenceClass":"academic-research","outcomeClass":"cautionary","topics":["developers-agents","data-security"],"finding":"Preprint, not peer reviewed. The authors evaluated four automated C-to-Rust refactoring approaches (C2Rust-analyze, CROWN, C2SaferRust and FLOURINE), some using LLMs, on 116 C programs with memory security bugs from the NIST Juliet Test Suite, producing 464 Rust programs. 342 failed to compile, 177 inherited memory security bugs from the original C, and 77 new Rust bugs were introduced. They conclude the tools deliver memory safety as they define it, but not broader memory security. Why now: Cisco’s president said on Oct. 30-31 that AI-assisted rewriting could speed Cisco’s migration to memory-safe languages; this is the most relevant independent evidence on that claim.","sledRelevance":"Gives SLED security leaders an independent check on vendor claims that AI or automated translation into memory-safe languages makes software safer. It applies to Cisco’s stated direction and to agencies considering similar modernization of their own C/C++ code.","evidence":"Empirical study on a standard synthetic test suite (116 programs, four tools, 464 outputs), measuring compilation, inherited bugs and new bugs. Read from the arXiv abstract page.","architectureImplications":"Translated code needs compile, behavior and security testing; reducing “unsafe” Rust is not the same as removing vulnerabilities.","governanceImplications":"Vendor and agency claims of memory-safety gains should be backed by security test results, not just the share of code translated (interpretation).","securityPrivacyImplications":"Automated translation can carry original memory-security bugs forward and introduce new ones, so a rewrite does not substitute for vulnerability testing.","caveats":"Preprint, not peer reviewed; I read the abstract page, not the full paper. Juliet programs are small synthetic test cases, not production networking code. The tools studied are research tools, not Cisco’s (unknown) toolchain. The study does not evaluate the general-purpose LLM coding agents Cisco may use.","streamIds":["cisco"],"roles":{"sales":"Sales framing: use this to keep memory-safety conversations honest. When customers or partners cite Cisco’s plan to rewrite code with AI, this preprint shows that automated translation to Rust can leave bugs in place and add new ones. That supports positioning around verifiable patch performance and security testing, not language labels. It is a preprint on synthetic test programs, so present it as a caution, not as proof that Cisco’s effort will fail. Avoid overstating either way.","engineering":"Engineering framing: across 464 translated programs, 342 did not compile, 177 kept the original memory-security bug and 77 had new Rust bugs. The lesson for SLED engineers evaluating vendor or in-house rewrites is to ask for security test evidence, such as fuzzing, static analysis and known-bug regression, rather than accepting “rewritten in a memory-safe language” as a control. The study used research tools on small Juliet programs, so transferability to commercial networking code and modern LLM agents is limited.","delivery":"Delivery framing: in any SLED modernization that translates C or C++ code, build security testing into acceptance alongside functional equivalence. Plan for compile failures and rework, re-run known-vulnerability test cases against the translated code, and track new defects introduced. When customers ask whether vendor rewrites change their patching duties, the answer is no until advisories show it. Record this preprint as a reference in security review checklists, and update it if a peer-reviewed version appears."},"roleDetails":{"sales":{"customerProblem":"Customers hear that rewriting code in memory-safe languages, increasingly with AI, removes vulnerabilities, but have no independent evidence of how well that works.","stakeholders":["CISO","Application security lead","Software modernization program manager"],"discoveryQuestions":["What evidence would you require before crediting a rewrite with security improvement?","Do your acceptance tests include known-vulnerability regression?"],"valueHypothesis":"Bounded: adding security regression to modernization acceptance avoids false assurance from translation alone.","potentialEngagement":"Security-acceptance criteria workshop for an existing or planned code modernization effort.","unsupportedClaims":["That AI or automated translation guarantees memory security","That Cisco’s rewrite will or will not succeed","Results transfer directly to production networking code"]},"engineering":{"fit":"Evaluation evidence for any automated or AI-assisted C/C++ translation.","architectureIntegration":"Applies to CI pipelines: compile checks, known-bug regression, fuzzing and static analysis on translated output.","prerequisites":["Known-vulnerability test cases for the code being translated","Static analysis and fuzzing tooling"],"constraints":["Synthetic Juliet programs; research tools only","Preprint not peer reviewed"],"security":"Translation can inherit or introduce memory-security bugs; test the output.","proofOfValue":["Re-run original vulnerability test cases on translated code","Count new defects introduced by translation"]},"delivery":{"work":"Add security regression to modernization acceptance tests.","dependencies":["Test corpora","Security tooling in CI"],"ownership":"Application security lead.","skillsAdoption":"Teams need Rust and secure-coding review skills.","governanceCheckpoints":["Security sign-off requires regression evidence, not just translation rate"],"acceptanceCriteria":["Proposed: zero inherited known vulnerabilities in translated modules before release","Proposed: new-defect count reported per release"],"risks":["False assurance from language migration","Rework from compile failures"]}},"retrievedAt":"2026-11-01T03:07:28Z","enrichedAt":"2026-11-01T03:12:58Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Rust and secure-code review skills are needed to judge translated code; the study implies human expertise remains essential.","procurementImplications":"Supports requiring security test evidence, not just a language-migration claim, in vendor questionnaires and modernization contracts (interpretation).","operatingModelImplications":"Security regression testing becomes part of every translation-based modernization release cycle.","peerReview":"preprint","sourceVerification":{"openedUrl":"https://arxiv.org/abs/2609.25682v1","referenceExcerpt":"342 Rust programs fail to compile, 177 Rust programs inherit memory security bugs from the original C programs, and 77 new Rust bugs are introduced.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}