Google engineer uses Gemini 4 Argon and Z3 to catch Go bounds bugs
Start here
A Google engineer who leads the company's agent skills program built a pipeline in which Gemini 4 Argon reads Go source and RISC-V disassembly and converts surviving runtime.panicBounds traps into Z3 constraints; go test then replays any satisfying input as a real reproducer. According to the engineer's account, the workflow caught all three planted bugs and three latent bugs in skill-lint. Unseeded go test -fuzz missed two of the planted crashes, because Go checks slices against capacity rather than length. Clipping capacity to length with data[:len(data):len(data)] made the fuzzer crash both overrun bugs in all three runs, with medians of 0.28 s and 0.17 s.
Generated from reports · updated 13 h ago
Report timeline
Follow the reports to see the event from different sides.
- Google Developers BlogGoogle engineer uses Gemini 4 Argon and Z3 to catch Go bounds-check bugs fuzzing misses
A Google engineer who leads the company's agent skills program built a pipeline in which Gemini 4 Argon reads Go source and RISC-V disassembly and translates surviving runtime.panicBounds traps into Z3 constraints, then go test replays any satisfying input as a real reproducer. The workflow caught all three planted bugs and three latent bugs in skill-lint, while unseeded go test -fuzz missed two of the planted crashes because Go checks slices against capacity rather than length. Clipping capacity to length with data[:len(data):len(data)] made the fuzzer crash both overrun bugs in all three runs, with a median of 0.28 s and 0.17 s.
Heat for this event
Not enough continuous observations yet to draw a trend.