Rust & AI Weekly #10: what runs before your code does

Welcome back to Rust & AI Weekly, the curated, vetted sweep of crates and tools showing up where Rust meets AI. Today's issue: a crate with 245 million downloads shipped a build script that phoned home for 86 minutes, the Rust tool that would have sandboxed it has been sitting there since 2023, and the ecosystem finally put money on the maintainers whose credentials are the attack surface. The theme this week is what runs before your code does: cargo build is not a read-only operation, it is an execution environment with your credentials in it, and almost nobody treats it as one. Last week's genre was drawing a boundary and putting a mechanism on it. This week the boundary in question is the one between "I added a dependency" and "I ran a stranger's program as me", and the ecosystem spent the week discovering it in three different ways at once.

(Status lines reflect public signals as of August 31, 2026; stars and downloads are approximate and move fast.)

This week's radar: five new entries join the map, bringing it to 70 tools. Explore the interactive version.

The week's anchor

Before the picks, the thing they are all reacting to. On August 20 at 07:15 UTC, arrayref@0.3.10 was published to crates.io with a new dependency on a typosquatted crate called proc-macro1, whose build script downloaded and executed a remote payload. internment and append-only-vec, by the same author, went the same way within twenty minutes. The Security Response Team, tipped off by the research team at Nextron Systems, deleted the malicious versions inside 86 to 107 minutes and locked the account. Manish Goregaokar wrote it up the same day, and the report is careful about the part that matters most: the maintainer is not believed to have acted maliciously, their machine or their credentials were compromised.

Two things make this worth more than a security bulletin. The first is scale: arrayref has around 245 million all-time downloads and 403 direct dependents, so "did I pull it" is a question almost every Rust shop had to answer that morning. The second is the mechanism. Nothing had to call the malicious code. Building was enough, because a build script is an arbitrary program that cargo runs on your machine, with your environment, before a single line of your crate compiles. Every entry below is a different answer to that.

Pick of the week

cargo-acl 0.9.1 (Cackle) — David Lattimore's code ACL checker leads this issue because it is the tool that already solved the thing that happened last week, and it has been sitting quietly on GitHub since 2023 with 274 stars, which tells you something uncomfortable about how the ecosystem prices this problem. Cackle does two jobs. The first is the one in the name: it analyses every crate in your transitive dependency tree to work out which API categories that crate actually reaches, then fails the build when the answer surprises you. A crate whose description says it slices byte arrays should not be touching sockets. Cackle notices, and it ignores dead code, so a network call that is never reachable from your binary does not fire a false alarm. The second job is the one that matters this week. With bubblewrap installed, Cackle runs build scripts, tests and rustc itself inside a sandbox, and critically the sandbox for each build script is configured separately, so one build script that legitimately needs network access does not buy network access for the other four hundred. Under that configuration, proc-macro1 would have been a failed build rather than a compromised laptop. Sandboxing rustc sandboxes proc macros too, which the README notes is coarser: grant network to one proc macro and you grant it to all, though proc macros that need the network are rare enough that this is mostly fine. Two honest limitations, both of which Lattimore states himself in the README rather than making you find out. It is Linux only, and it is explicitly not a guarantee: a determined author can detect that they are running under Cackle and emit different code, and the stated goal is to raise the bar for sneaking something past review, not to replace review. The maintenance signal is the real caveat for adoption. 0.9.1 landed in May 2026 with fixes for V0 symbol mangling and an MSRV bump, so it is alive and tracking the compiler, but it is effectively one person who also writes the wild linker, and nine releases in three years is not a fast train. Against that: exit cost is a CI job and a cackle.toml, which is about as cheap as a bet gets. Go deeper with Lattimore's original Making Rust supply chain attacks harder with Cackle, which is the design rationale and reads very differently now than it did in 2023.
Maintenance: maintained but slow cadence, effectively solo (David Lattimore, who also writes the wild linker); 9 releases, 634 commits · Latest: v0.9.1 (May 7, 2026) · Adoption: Trial; start with the sandbox on build scripts in CI, which is the whole value in one flag, and leave the full API ACL pass for when someone has a week

Supply chain

cargo-vet — Mozilla's audit-enforcement tool is the other half of the answer, and the reason it gets a section rather than a bullet is that somebody finally measured what it costs. Cargo-vet enforces the invariant that every active dependency is either audited or explicitly exempted, with audits shared as importable .toml feeds from Mozilla, Google, the Bytecode Alliance and six others. Unlike a CVE scanner it is proactive: it can stop malicious code entering the build rather than reacting after the advisory lands. Firefox, Chromium, Tauri and Wasmtime all run it. Then, on August 12, Light Squares published A look at cargo-vet in 2026, which scraped 408 adopting repositories and 7,016 audits and put numbers on the parts nobody advertises. Adoption grew 101% this year. Every one of the top 100 downloaded crates is audited by somebody, dropping to 90% of the top 500 and 71% of the top 1000, with reqwest the first unaudited crate at download rank 138. But the median project carries 131 exemptions, the mean 206. A project that wants to stay genuinely fully vetted faces a median 8,700 changed lines of review per week, over 50,000 at the 90th percentile. The median lag from a crates.io release to its first registry audit is 29 days. And for published RustSec advisories, an audit of the fixed version existed only 29% of the time when the project shipped the fix, while 40% of adopted fix versions were never audited at all. That is not an argument against cargo-vet, it is an argument for being precise about which slice of it you buy. The default safe-to-run criterion exists specifically to rule out credential exfiltration and reverse shells, and gating CI on safe-to-run before any build step executes is a cheap, high-value control that protects your production tokens. Full safe-to-deploy coverage across a large tree is an FTE conversation, and pretending otherwise is how you get rubber-stamped audits, which are worse than none because they look like diligence.
Maintenance: actively maintained (Mozilla); 9 official audit registries including Mozilla, Google and the Bytecode Alliance · Latest: in continuous use; ecosystem measured Aug 12, 2026 by Light Squares · Adoption: Trial, not Adopt, and the burden data is exactly why; 408 public repos including Firefox, Chromium, Tauri and Wasmtime, 326 of them importing at least one feed

Agentic tooling

r3bl-rust-analyzer-mcp-server — Nazmul Idris shipped an MCP server that bridges coding agents to a rust-analyzer LSP subprocess, so an agent can ask the type system where a symbol is actually used instead of grepping for it and guessing. That is a good idea on its own, and it is not the reason this is here. The reason is the write-up he attached to it, which argues that he deliberately left Tokio out. His case: MCP over stdio is a 1:1 local pipe, a work-stealing multi-threaded runtime buys you nothing on a 1:1 local pipe, and the reflex to reach for Tokio the moment the letters I and O appear is async-by-default dogma rather than engineering. What he built instead is a synchronous three-thread pipeline over standard library threads, where the reader threads terminate naturally on EOF, and he notes he arrived here partly because agent processes were eating CPU and crashing on him. Anyone who has debugged a Tokio task that never gets joined will recognise the shape of that. This is the kind of entry where the artefact is the reasoning: single maintainer, part of the larger r3bl-open-core workspace, and worth reading before you write your fourth MCP server this quarter.
Maintenance: actively maintained inside r3bl-open-core (Nazmul Idris) · Latest: published on crates.io; design write-up dated Aug 22, 2026 · Adoption: Assess; useful today for driving Antigravity, Claude Code or Cursor against rust-analyzer, single maintainer, and the highest-value thing in it is the architectural argument rather than the binary

Observability

swift-topomap 0.2.3-beta — This Week in Rust 666's Crate of the Week, self-suggested by Ankur Rathore of SwiftLogic Systems. It is a ratatui TUI that maps your physical topology, NUMA nodes, L3 cache boundaries and cores, from a hand-written Rust sysfs parser rather than libhwloc, then overlays live microarchitectural counters via eBPF CO-RE: instructions per cycle, cache misses, and process names pinned to physical cores through sched_switch hooks. The pitch is that htop tells you a core is busy and this tells you whether the core is computing or stalled waiting on memory, colour-coded green versus amber. If you run inference servers or tokenizers, you have almost certainly had the conversation where something reads as 100% CPU and gets no faster, and IPC is the number that ends that conversation. A single 3.5MB statically linked binary, Apache-2.0 and MIT, validated by the vendor on Intel Xeon bare metal at 1.39 IPC compute-bound and 2.58 under cache stress. Now the caveats, which are substantial and which the project is upfront about. It is beta, Linux and eBPF only, 44 commits old, zero stars and zero external adopters at the time of writing, and the first open-source release from a single vendor. The documented install is curl a release binary and run it under sudo, which in an issue about build-time trust is worth saying out loud even though it is the ecosystem's own default. And the credits state that the architecture and the kernel-level eBPF C were developed via AI pair programming with Gemini. I would rather have that disclosure than not, and the same disclosure is a reason to read the kernel-adjacent code before you run it as root, which happens to be exactly the review posture the rest of this issue is arguing for.
Maintenance: brand new, single vendor (SwiftLogic Systems; Ankur Rathore self-suggested it); 44 commits, first open-source release · Latest: v0.2.3-beta (Aug 2026) · Adoption: Assess; run it on a machine you are already profiling, read the eBPF before you sudo, and do not put it in a fleet rollout yet

Data plumbing

comrak — this one arrives from the Go side. Go Weekly led its Code & Tools section with Goldmark 2.0, Yusuke Inuzuka's first breaking release in seven years, and the headline feature is position info on every AST node. Rust's seat at that table is Asherah Connor's comrak, which already reports source positions, and the AI reason to care is not markdown rendering at all. It is that RAG chunking without byte offsets means your citations point at a document, and RAG chunking with byte offsets means they point at a sentence. Comrak builds a real mutable AST you can walk and rewrite, passes 652 of 652 CommonMark tests and 670 of 670 GFM tests, and carries the full set of GitHub extensions plus footnotes, math, wikilinks and front matter. Stewardship is better than the usual open-source story: Connor has had comrak inside the scope of her paid work since September 2025, and the crate backs commonmarker on Ruby, MDEx on Elixir and the Python bindings, so a lot of ecosystems would notice if it stopped. The tradeoff is stated in comrak's own README, which is a nice quality in a maintainer: it models cmark-gfm closely so its behaviour is predictable and its bugs are inherited, and it is slower than Raph Levien's pulldown-cmark, the no-AST pull parser that cargo doc uses. Pick comrak when you need to walk or rewrite the tree, pick pulldown-cmark when you need throughput and no AST.
Maintenance: actively maintained and partly funded (Asherah Connor / kivikakk; in scope of her paid work since Sep 2025) · Latest: v0.54.x line, exact release date unverified this run · Adoption: Adopt for source-position-aware markdown parsing; ~1.7k stars, 148 dependent crates, and downstream bindings in three other languages

Language watch

• The never type is stabilized — PR 155499 merged this week, ending one of the longest-running "any day now" features in the language. ! as a real type means "this function does not return" stops being folklore and starts being checkable.
• min-publish-age is in final comment period at Cargo — PR 17335, still open for objections. It has been in this section since issue #8, and this week it stopped being a nice idea: a minimum age before a newly published version is resolvable is precisely the control that turns an 86-minute window into a non-event.
• cargo install now uses locked dependencies — PR 17377. Small change, same week, same direction: installing a tool should build what its author tested, not whatever resolved this morning.
• The next-gen trait solver is on by default on nightly — PR 160619, with an announcement post to match. Perf triage this week, done by @simulacrum, reports 2 regressions, 4 improvements and 2 mixed across 28 artifact comparisons, which is a busy but unalarming week for the biggest compiler-internals change in years.
• Function overloading has a call for experimentation — inside-rust post. Worth an opinion before it has momentum.

In brief

Scaling Memory Safety: AI-Assisted Rewrites of C/C++ Dependencies to Rust — Google's bughunters team on using AI to port giflib to Rust, which is the first version of this argument I have seen with an actual dependency at the end of it rather than a benchmark · Replacing a Rust Enum with a 64-bit Word Made My Interpreter 17% Faster — a specific, measured win, and a good reminder that enum layout is a performance decision · Beyond WASI: Rust applications in-browser — the sequel to last week's tokio_with_wasm entry, from the other direction · 3 Seconds of compilation shaved by metadata analysis · Proving SQLx's Statement Cache with bpftrace — verifying a library's claim about itself instead of believing the docs, which is this issue's theme in miniature · One trie, three jobs, zero benchmarks won — an honest write-up of an optimisation that did not work, which is rarer and more useful than the other kind · Your E-Paper Panel Isn't Broken: How Retained State Makes Drivers Look Buggy · Intent to Ship: JPEG XL — Mozilla shipping a Rust decoder for a new image format in Firefox, which is the memory-safety argument winning quietly · Clippy got PGO-optimized and a batch of new lints this week, including is_ok/is_err suggestions for boolean Result mappings and a less aggressive needless_bool.

Elsewhere

• The Rust Project announced its first Maintainers in Residence, and the timing is almost too neat. Gen Li (@rami3l), Chris Denton (@ChrisDenton), Alejandra González (@blyxyas) and León Liehr (@fmease) are funded for at least twelve months, with Maintainer Grants to Jason Newcomb (@Jarcho) and Jonas Böttiger (@joboet), paid out of $350K donated to the Rust Foundation Maintainers Fund by Google, AWS, OpenAI, the Leadership Council and individuals. Read that next to the arrayref report. The attack did not exploit a language flaw. It exploited one unpaid volunteer's laptop. Funding maintainers is a supply-chain control, and it is the only one on this page that also makes somebody's life better.
• Go 1.27 shipped experimental simd and archsimd packages, and Sylvain Kerkour got 7.5x faster ChaCha20 out of them without writing a line of assembly, with pure Go nearly matching the hand-written version on arm64. The Rust pairing is fearless_simd, which was issue #8's lead and is still Trial, with 1.0 booked for early September. I flagged the same shape of gap last week with PGO and I am going to keep flagging it: Go is putting performance primitives in the toolchain, and Rust's equivalents are excellent third-party crates while std::simd stays on nightly. Third-party is not worse. It is just a different bet about who does the integration work, and the ecosystem should notice it is making the same bet twice in two weeks.
• Thomas Ptacek wrote Stop Making TUIs, arguing we build terminal interfaces because we have to rather than because we should. This week's Crate of the Week is a ratatui app. Read it anyway, ideally before your next internal tool, because the honest version of his argument is that a TUI is a distribution decision disguised as a design decision.

A thought for the week

cargo build is not a read-only operation.

I suspect most engineers know this in the way you know that your car has an engine, which is to say abstractly and never at a moment when it matters. Adding a dependency feels like reading. It feels like fetching a file. What actually happens is that an arbitrary program written by a stranger executes on your machine with your environment, your SSH agent, your cloud credentials and your network, before your own code compiles, and it does this on every developer laptop and every CI runner in the org. Last week that stranger's program was live for 86 minutes on a crate with 245 million downloads, and the only reason the blast radius was small is that a research team happened to be looking.

What strikes me about the response is that the tooling already existed. Cackle has been able to sandbox build scripts since 2023. Cargo-vet has been enforcing audit gates since 2022 and Firefox and Chromium both run it. min-publish-age has been in final comment period since issue #8. None of this needed inventing; it needed adopting, and it did not get adopted because the cost is paid up front by the team that adopts it and the benefit is paid out to everyone, eventually, in incidents that never happen. That is the standard shape of a security control and the standard reason it does not ship.

So here is the leadership question, and it is a budget question rather than a technical one. Your build pipeline currently runs untrusted code with production-adjacent credentials. What is the cheapest control you could put on that this quarter? Not the complete one. The cheapest one. A safe-to-run gate in CI before any build step touches your tokens is roughly an afternoon. A bubblewrap sandbox on build scripts in one repository is roughly the same. Neither is comprehensive and both would have stopped this specific attack. The teams that will handle the next one well are not the teams with the best threat model, they are the teams that shipped the cheap control while the incident was still fresh enough to justify the sprint capacity. That window is open right now, and it closes in about two weeks.

Before I go

Rust Bytes has been on a bi-weekly cadence, so this week's competitive read was Go Weekly, which came back from a break with Go 1.27 in hand. Worth noting for anyone tracking cross-ecosystem borrowing: Russ Cox is arguing for a text/markdown package in the Go standard library on the grounds that it would be simpler and more spec-compliant than Goldmark. Rust has three good markdown parsers and none of them in std, and I think that is the right outcome, but it is the same toolchain-versus-crate question as the SIMD one above, asked about a different layer.

Also: RustConf is next week in Montreal, September 8 to 11, with the Rust Teams Health Summit alongside it, and Oxidize follows in Berlin September 14 to 16. fearless_simd 1.0 is still booked for early September with no breaking changes planned, so if you own inference kernels and you have an API objection, this is the last week it is free.

And if you have not yet: go run that find ~/.cargo/registry/cache one-liner from the Rust Security Response report. It takes two seconds and it is the only item in this issue that requires no meeting.

That's the issue. Got a Rust+AI crate or tool I should feature next week? Reply and tell me; reader picks shape the list.

Keep shipping, Decebal