Why software is converging on Rust in the age of AI

For about a decade, "rewrite it in Rust" was a joke. It was what an excitable stranger posted under every bug report in a C++ project, and the reply was some polite version of no, because rewrites took years and broke things that already worked. Dropbox spent years moving its sync engine from Python to Rust, and its own write-up warns that in many companies it would have been a terrible idea.

Over a few months in 2026, one large project after another did it anyway, and none of them took years. In February, Andreas Kling moved the JavaScript engine of the Ladybird browser from C++ to Rust in about two weeks, and it passed all 52,898 tests of the official JavaScript conformance suite with byte-for-byte identical output. In May, Bun, the JavaScript runtime, went from 535,000 lines of Zig to Rust in 11 days, with up to 64 Claude agents working through roughly 16,000 compiler errors. Meta merged a Rust version of the React Compiler in June and describes most of it as written by AI. By September, a single engineer at GitHub directing up to 22 agents had turned the TypeScript runtime behind Copilot into 832,000 lines of Rust. And in October, a solo developer named Brandon Thomas published open-source Rust clones of Photoshop, Illustrator and Premiere, built by directing Claude, and collected 70,000 GitHub stars in three weeks.

ForrestKnight's video on this has the best one-line summary I've seen: Rust didn't change this year, the cost of rewriting did. It's 25 minutes and worth it.

He's right, and it's half the answer. Cheap rewrites explain why teams are switching languages now. They don't explain why so many are switching to the same one, when Go, Zig and modern C++ were all available. The other half is about who reads the code. When an agent produces a thousand lines an hour, nobody reviews all of it, so whatever the compiler checks for free ends up carrying most of the weight. Rust's compiler checks more than any other mainstream language's, and agents turn out to be good at taking its feedback.

Rewrites used to take years

Choosing a language used to be one of the few permanent decisions in a project. You could swap a database or a cloud provider, but changing languages meant pausing feature work for a year or more while a team re-implemented everything and chased down the behaviour that shifted along the way. Jarred Sumner, who created Bun, described language choice for a project like his as having been "a one-way decision" until very recently.

The fish shell is a good picture of the old cost. Its move from C++ to Rust, finished in 2024 without AI, took almost two years and more than 200 contributors to port 57,000 lines. Compare that with this year:

You can see the result on GitHub. A project's language bar is computed from its source files, and Bun's now looks like this:

These numbers deserve some care. Bun's port cost around $165,000 in API usage and needed one very experienced engineer watching it the whole time. Sumner's own estimate for doing it by hand was three engineers for about a year. Kling describes Ladybird's port as "human-directed, not autonomous". And Bun is owned by Anthropic, whose models did the work, so its write-up is partly a showcase. Even so, the cost of switching languages has fallen by something like two orders of magnitude.

One thing shows up in every port that worked: a test suite that doesn't care what language the code is in. Bun's tests are TypeScript that drives the runtime from outside, so the same 60,000 tests could judge the Zig version and the Rust version. Ladybird had test262, the official JavaScript conformance suite. Agents translate quickly, and the test suite is what tells you whether the translation is right.

The big players are betting on the same idea. In December 2025, Microsoft Distinguished Engineer Galen Hunt set a goal of "1 engineer, 1 month, 1 million lines of code" for AI-driven translation of C and C++ into Rust, then clarified that Windows isn't being rewritten and the work is a research project. DARPA runs a program called TRACTOR, short for Translating All C to Rust, with the same aim.

The compiler became the first reviewer

Cheap rewrites move the bottleneck. GitHub's port produced 832,000 lines of production Rust and another 469,000 lines of tests in three and a half months. No one read that line by line. The checking moves to things that can keep up: the test suite, other agents set up as hostile reviewers, and the compiler.

Of those, the compiler is the one that runs on every single change, in seconds, and never gets tired or changes its mind. Bun's agents used the output of cargo check, Rust's fast type and borrow check, as their to-do list. They burned down those 16,000 errors crate by crate before running a single test. Sumner explained the choice of Rust over a stricter Zig style guide in one line: compiler errors are a better feedback loop than a style guide. A style guide depends on someone noticing the violation. A compiler error stops the build.

Here's what that loop looks like on a small change, with two real compiler errors in it. Press play, or step through it.

There's research behind this now. A 2026 paper on generative compilation tested seven models on repository-sized Rust tasks. Left alone, the models wrote Rust that didn't compile 65.9% of the time on average; the paper is frank that Rust is harder to get right on the first try than permissive languages like C. Feeding the compiler's errors back after generation cut that to 20.7%, and checking partial programs while the model was still writing cut it to 13.1%. In one setup, a frontier model went from 51.7% non-compiling to zero.

What surprised me is how well agents do with Rust once that loop is in place. On SWE-bench Multilingual, a benchmark built from real GitHub issues in nine languages, the tested agent resolved Rust issues at the highest rate of any language, 58%. C and C++ came last at 29%. There are only 43 Rust tasks, so I wouldn't lean hard on the exact number, but it points the opposite way from the usual worry that agents would struggle with Rust because there's less of it to learn from. And in GitHub's Copilot port, the dreaded ownership and borrowing errors made up just 1.7% of all the compile errors the agents hit. Most were ordinary slips with names and types.

What Rust's compiler catches that others don't

Every typed language checks something. What matters is how many kinds of bug get turned into compile errors, and Rust covers several kinds that other languages leave to tests, sanitizers or luck. Pick a bug and see when each language finds it:

Memory bugs

Use-after-free, double free and reading past the end of a buffer are the classic C and C++ bugs, and they're behind most serious security holes. Microsoft has said for years that about 70% of the CVEs it assigns are memory-safety bugs, and Chromium reports the same share of its high and critical bugs. In safe Rust, the ownership rules make all of these compile errors. Bun's last Zig release notes read like a catalogue of them: use-after-frees in node:zlib and node:http2, a double free in the CSS parser, leaks on error paths.

Android has the longest track record. Google has written new Android code in Rust since 2019, and reported in November 2025 that memory-safety bugs had dropped below 20% of Android's vulnerabilities for the first time, down from 76% in 2019. Android's C and C++ code runs at roughly 1,000 memory-safety vulnerabilities per million lines. Its 5 million lines of Rust have had one near miss, about 0.2 per million. Rust changes also had a 4x lower rollback rate and spent 25% less time in code review, and once agents write the code, review time is the part that doesn't shrink.

Data races

Rust tracks which types can safely move or be shared between threads, through two traits called Send and Sync, and refuses to compile code that would share something unsafely. In TypeScript, Go or C++, a data race compiles and fails now and then in production. Daniel Szoke from Sentry built a whole talk, Why Rust is the Ideal Language for Vibe-Coding, around this: the Rust compiler names the exact type that can't cross threads, which points the agent straight at the fix.

Forgotten cases

A match on an enum has to handle every variant. Add a new status, and every match that doesn't handle it becomes a compile error with its location. Agents are good at the change you asked for and worse at finding the six other places it should ripple to. Rust turns that hunt into a list.

Failure paths

Rust has no exceptions and no null. A function that can fail returns a Result, a value that might be missing is an Option, and the compiler makes the caller handle both before touching what's inside. You can tell from a function's signature whether it can fail, which is most of what a reviewer wants to know.

Error messages a model can act on

rustc errors give the exact location, explain why, and often include a suggested edit. The same output comes as JSON, with each suggestion marked by how safe it is to apply automatically, and cargo fix applies the safe ones. The Rust project built this for people years before coding agents existed. For a model in a loop, it's close to a set of instructions.

One toolchain everywhere

Every Rust project builds with cargo, tests with cargo test, lints with cargo clippy and formats with rustfmt. An agent that knows one Rust project knows how to build and check all of them. In C++, the build system alone can take a new human days to figure out.

Rust had all of these properties in 2018, and for years the effort of satisfying its compiler kept a lot of people away. That effort is exactly the part agents are happy to grind through, and the payoff, code that's been checked before anyone reads it, is exactly what you need when nobody can read it all. Niko Matsakis, a longtime lead of the Rust language team, makes a similar case: Rust's old promise that code which compiles usually works matters more when an agent is the one compiling.

Rust is spreading well past the server

The usual story about Rust is infrastructure, and that's where it paid off first. Cloudflare's new core proxy is Rust and answers 10 ms faster at the median on less than half the CPU. AWS rebuilt Aurora DSQL from the JVM to Rust after the Rust prototype ran 10x faster than tuned Kotlin. But over the last two years Rust has moved into places that have nothing to do with servers. Click around:

Browsers

Browsers parse untrusted input from every website on earth, so they were early adopters. Firefox has had Rust inside since its CSS engine, Stylo, shipped in 2017, and its WebGPU support is built on wgpu, a Rust graphics library. Chrome replaced the FreeType font library with a Rust font stack called Skrifa and removed FreeType from Blink entirely in Chrome 145. Chromium's JSON parser is Rust too, because that's what makes it safe to run on untrusted input at high privilege.

The most interesting browser story is Ladybird, a new engine built from scratch by a nonprofit. In 2024 it picked Swift as its future language. In February 2026 it dropped Swift, because the C++ interop "never quite got there", and moved to Rust, starting with the JavaScript engine that agents helped port in two weeks.

Operating systems

Kernels are where a single memory bug becomes a security hole, and Rust is now inside Windows, Linux and Android. Windows has shipped Rust in the kernel since 2024, starting with the code that handles GDI regions. The Linux kernel declared its Rust experiment over in December 2025, which means Rust is now a permanent part of Linux. Android's Binder driver has a Rust rewrite in mainline, and there are Rust GPU drivers for Arm Mali, Apple silicon and, still early, NVIDIA. In Android itself, new Rust code overtook new C++ in 2025.

Mark Russinovich's RustConf 2025 keynote is the best account of how this went inside Microsoft, including a bug that would have been a privilege escalation in C++ and became a clean, reproducible crash in Rust:

Above the kernel, System76 shipped COSMIC, a whole desktop environment written in Rust from the ground up, as the default in Pop!_OS 24.04.

Graphics, 3D and creative tools

This is the part I know best, because I'm building in it. The 3D editor I'm working on is Rust compiled to WebAssembly, drawing with WebGPU from a worker in a browser tab. Two years ago that would have been an odd choice. Now it's fairly ordinary.

The biggest surprise of the year was PhotoCraft. In October, Brandon Thomas published PhotoCraft, an open-source Photoshop alternative written in Rust, along with sibling projects for Illustrator, Premiere, Lightroom and other Adobe apps, built mostly by directing Claude agents. It has layers, adjustment curves, masks and 67 tools, and it re-saves Photoshop files that match the originals in 307 of 309 test cases.

It's honest about being early alpha and not yet a tool for professional work, and whether its "clean-room" process holds up legally is an open question. Adobe wasn't involved and hasn't commented. But a few years ago, a credible Photoshop alternative would have needed a funded company and years of work.

Graphite is another creative tool in the same spirit: a node-based vector and raster editor written in Rust, still in alpha, that mixes layers with procedural, generative editing:

Zed, the code editor, reached 1.0 this year on GPUI, its own GPU-rendered UI framework in Rust, with agents built in. Bevy is the most active Rust game engine, and Vello renders 2D vector graphics entirely on the GPU. Figma moved its multiplayer server to Rust back in 2018.

Developer tools

Python's tooling is now largely Rust underneath. Astral's uv, ruff and ty, whose company joined OpenAI in March, are among the most downloaded packages in the ecosystem. pydantic-core, the Rust engine inside Pydantic, was downloaded about 808 million times in a single 30-day stretch this autumn, roughly twice as often as pip itself. JavaScript went the same way: Turbopack is the default bundler in Next.js 16, and Vite 8's Rust bundler, Rolldown, cut Linear's production build from 46 seconds to 6.

The coding agents themselves are moving too. OpenAI's Codex CLI left Node for Rust to get a dependency-free install and native sandboxing, and is now about 97% Rust. GitHub's Copilot runtime followed, xAI's Grok Build shipped in Rust from day one, and Warp, the terminal that has turned into an agent workspace, has been written in Rust and drawn on the GPU from the start.

The AI stack

The code around AI models has been picking up Rust for years. Hugging Face's tokenizers library and the safetensors file format are Rust, and almost every model download pulls in both. In May, vLLM, the most popular open-source inference server, merged an optional Rust frontend because the Python frontend had become the CPU bottleneck. In their benchmark, the Rust version cut median time to first token from 166 ms to 50.5 ms. The proposal argued that, with coding agents around, the old objection that contributors can't read Rust is "minimized".

Where Rust isn't winning

Rust has made little headway in three areas that matter a lot, GPU kernels, research code and games, and in a few others another language won on purpose.

GPU kernels

The code that actually runs AI models is still CUDA C++, plus more and more Python. NVIDIA's recent bets are Python-first: cuTile Python, the CuTe DSL in CUTLASS 4, and native CUDA Python. NVIDIA did announce official CUDA Rust in September, with two tracks called cuda-oxide and cutile-rs, but by its own description neither is production-ready, and it calls CUDA C++ and Python the mature toolchains. The community Rust-CUDA project came back to life in 2025 after three dormant years and is still early. If you write kernels for a living, Rust isn't on your list yet.

Research and training

Research lives in Python because researchers iterate in notebooks, and PyTorch and JAX are Python on top of C++ and CUDA. The biggest inference engines are Python or C++ as well: llama.cpp has about 132,000 GitHub stars and vLLM about 95,000, while the leading Rust ML framework, candle, has about 21,000. Hugging Face's TGI, the best-known inference server with a Rust core, is now in maintenance mode, and its own docs point people to vLLM and SGLang. So far Rust takes the always-on pieces around the model (the server frontend, the tokenizer, the file format), Python keeps the places where people experiment, and CUDA keeps the maths.

Games

Unreal is C++, Unity is C#, and Bevy is on version 0.20. LogLog Games wrote a widely shared post, Leaving Rust gamedev after 3 years, after 100,000 lines: games need fast iteration and hot reloading, and the borrow checker kept forcing refactors when they wanted to try ideas. Agents make refactors cheaper, but they don't change how much game development values trying ten things in an afternoon.

Places where another language won

The most useful counterexample is TypeScript itself. When Microsoft rewrote the TypeScript compiler for speed, it picked Go, and TypeScript 7 shipped this year with full builds 8 to 12 times faster. The team's reasons were specific: they wanted a line-by-line port, Go's style is close to the existing code, garbage collection suits a compiler, and the compiler's syntax trees are full of cycles, which Rust's ownership model makes awkward. Zig keeps strong projects like Ghostty and TigerBeetle, whose authors chose it deliberately. Go still runs cloud infrastructure, from Kubernetes to Terraform. And Armin Ronacher, who knows Rust well, argues that Go and TypeScript are better languages for agents, partly because agents struggle with Rust's macros.

Bugs the compiler can't see

Rust's checks have edges, and agents find them too. Bun's port had 19 regressions, all in code that compiled. In one, a debug_assert! wrapped a call that had a side effect, so release builds quietly skipped the call and hot reloading broke. Cloudflare's November 2025 outage was a Rust proxy calling unwrap() on an error it had never seen before, which crashes by design. Check Point found a Rust panic in the Windows kernel that blue-screened the machine. Code at the boundary with C stays unsafe, around 4% of both Bun's and Android's Rust, and the Linux kernel's first Rust CVE came from an unsafe block. Rust also compiles slowly: in the project's 2025 survey, 55% of respondents wait more than 10 seconds for a rebuild, and an agent running hundreds of builds feels that too.

A panic is a better way to fail than memory corruption, and a crash is better than a silent security hole. Reviewers still have to read for logic errors, panics and unsafe; Rust just makes the list shorter.

Where this is heading

Put together, the stack seems to be sorting itself into layers, and no single language gets all of them. Code that runs all day, handles untrusted input, and has to be both correct and fast is moving to Rust: runtimes, browser engines, kernel drivers, toolchains, agent harnesses, inference frontends, creative tools. Agents are speeding that up twice, by making the port affordable and by doing the part of Rust people found tedious. Code where people are still exploring, like research, prototypes, scripts and UI glue, stays in Python and TypeScript, where the feedback loop is a person trying things. GPU kernels stay wherever NVIDIA's tools are best, which today means C++ and Python. And the huge body of existing C and C++ shrinks slowly, as efforts like Microsoft's research project and DARPA's TRACTOR mature.

That's my bet for the next five years, and parts of it could be wrong. If NVIDIA's Rust tracks mature, kernels could follow. If agents get much better at the first draft, the compiler's job as a reviewer matters less. But the direction over the last two years has been consistent, and it sped up in the last one.

Try it on your own agent

If you run coding agents on a codebase, a few changes help in any language and help most in Rust:

1. Put cargo check in the agent's inner loop, and cargo clippy -- -D warnings plus cargo test before it says it's done. The compiler is the cheapest reviewer you have.
2. Turn on the Clippy lints that catch agent shortcuts: unwrap_used and expect_used outside tests, and undocumented_unsafe_blocks so every unsafe needs a // SAFETY: comment.
3. Before porting anything, make sure the test suite runs from outside the code, in another language or as a black box. That's what made Bun's and Ladybird's ports checkable.
4. Use a second agent with fresh context as a hostile reviewer that only sees the diff and is told to assume it's wrong. Bun ran two of them on every change.
5. Read the diff yourself where the compiler can't help: logic, unsafe, unwrap, and anything that touches money or permissions.

That last step needs you to read Rust. If you don't yet, A Rust primer for humans goes from hello world to reviewing an agent's Rust diff, with Python alongside. For what's on the other side of the pull request, there's what an agent harness is and a walk through OpenCode's source. For the other side of the argument, Cliff Biffle's Common Pitfalls of Rewriting Things in Rust is worth an hour, and for where Linux is heading, so is Greg Kroah-Hartman's Untrusted data in Linux.