Goodbye, C++: AI Will Rewrite Critical Code in Memory-Safe Rust

The digital world still rests on crutches built in the last century. A huge share of critical infrastructure, from banking systems to government databases, is written in C and C++. These languages give programmers enormous power over a computer's memory, but, as we know, great power brings monstrous mistakes. Around 70 percent of all modern software vulnerabilities stem from improper memory handling. These are the very holes hackers have used for decades to break into protected systems. Until now there was no way out: rewriting millions of lines of old code by hand was too expensive, too slow, and simply too boring for skilled engineers.

The situation changed with Rust. Launched in 2015, the language promises the same performance as C++, but with built-in "safeguards" that physically prevent fatal memory errors. The problem is that Rust is a difficult language, and experts in it are many times fewer than fans of the classics. This is where artificial intelligence steps in. A new initiative called Great Refactor proposes using neural networks to finally clean out these Augean stables of legacy code. The idea is simple: if people don't want to or can't rewrite the internet in a safe form, let machines do it.

The Institute for Progress has launched a project that aims to convert 100 million lines of open-source code to Rust by 2030. It is asking for nothing less than 100 million dollars. That sounds like a hefty sum, but project lead Herbie Bradley of Cambridge quickly puts it in perspective. By his estimates, the investment would help prevent cyberattacks with combined damage of about 2 billion dollars. This is not just savings; it is a question of survival for a digital ecosystem that grows more fragile under the pressure of automated hacking tools.

Technically, the task looks less fantastical than it did a couple of years ago. Modern LLMs handle translating small chunks of code, up to 1,000 lines, quite decently with almost no supervision. With a little human oversight, neural networks can already "digest" projects of up to 5,000 lines. The main difficulty is not getting the code to run. It must be "idiomatic." In programmer terms, that means the code should look as if a living Rust expert wrote it, following all best practices and conventions. If the AI produces an unreadable mess that cannot be maintained, the whole point of refactoring is lost.

The defense agency DARPA has also entered the game with its TRACTOR program. It is exploring a hybrid approach: combining classic static code analysis, honed over decades, with modern generative models. That makes sense, because neural networks are prone to hallucinations, and when it comes to critical software, the price of a mistake is not just a crashed website but a potential collapse of life-support systems. So far, the first test results show that AI can be an excellent apprentice, but the role of chief architect still belongs to a human.

There is also a skeptical view. Experienced developers fear that mass translation of code to Rust will create a shortage of people to maintain it. Rust experts are scarce, and if we suddenly get millions of new lines of code in the language, who will keep them up to date five years from now? Moreover, government funding on this scale is unwieldy. The private sector may have to take the initiative, especially since tech giants like Google and Microsoft began moving their key components to Rust in-house long ago. Great Refactor, by contrast, targets the "long tail" of small libraries that are maintained by a couple of volunteers yet underpin half of the world's software.

Bottom line: Will AI be the "silver bullet" that kills memory vulnerabilities, or will we simply swap old bugs for new ones generated by a neural network?