Here is the unpopular take: an eleven-year-old unsoundness bug in the Rust borrow checker is the strongest argument I have seen all year for trusting the borrow checker. Not the weakest. The reaction I keep seeing — the knowing smirk, the “so much for memory safety” posting — gets the story exactly backwards.
On October 13, 2026, reports went around that long-standing soundness bugs had been found in Rust’s borrow checker. The specifics, as described: a struct’s lifetime requirements can be bypassed through covariant field assignment combined with a custom Drop implementation, letting a value escape the constraints the type system was supposed to enforce. AddressSanitizer confirmed the misbehavior. The reproduction goes back to Rust 1.4 in 2015, with a related case in 1.18.0 from 2017. The Rust type system team flagged it high priority, because the failure mode is memory corruption with no unsafe block in sight.
That last part is the scary sentence, and I am not going to soften it. No unsafe means the usual escape hatch for blame does not apply. This is the safe subset doing something it promised not to do.
Why I still read this as a good sign
I review tooling for a living, which mostly means watching vendors make claims and then watching what happens when those claims meet reality. There are two kinds of guarantee in this business. The first is marketing: a confident sentence on a landing page, unfalsifiable because nobody ever specified what would count as a violation. The second is a technical claim precise enough that someone can spend eleven years poking at it and eventually produce a counterexample, with a sanitizer trace attached.
Rust’s claim is the second kind. That is why there is a bug report, a reproduction, a priority label, and a team that owns the problem. Most tools I evaluate cannot generate this kind of news because their promises are too vague to break. When an AI coding assistant tells you its output is “safe,” there is no issue tracker where that sentence can go to die.
Eleven years is also a statement about difficulty. The bug required a specific interaction between variance and destructor timing. It did not fall out of someone’s first week with the language. If the safe subset were leaking everywhere, we would not be reading about a 2015 regression in 2026.
What this actually changes for your toolkit
Practically, for most readers, close to nothing. You should not be rewriting services this week. But there are a few adjustments worth making to how you think about the tools sitting on top of Rust.
- Compiler guarantees are empirical, not axiomatic. The borrow checker is an implementation of an idea, and implementations have bugs. Treat soundness as a very high probability, not a law of physics.
- Keep your sanitizers. AddressSanitizer is what turned a theoretical lifetime question into a confirmed memory problem. If your CI pipeline dropped sanitizer runs because “Rust handles that,” put them back.
- Generated code deserves more suspicion, not less. Code-generating assistants produce unusual type gymnastics — variance tricks, custom
Dropimpls, lifetime shapes a human would not have chosen. That is precisely the neighborhood where this bug lives. - Version floors matter. Reproducible since 1.4 and 1.18.0 means fixes will land in new compiler releases. If your build pins an old toolchain for stability, that stability now has a cost you can name.
The part the smirking crowd misses
The comparison people reach for is C and C++, where this class of problem is not a bug report but a Tuesday. In those languages, use-after-free is the expected consequence of ordinary code written slightly wrong. In Rust it took over a decade of adversarial attention to find a path to the same outcome through the safe subset, and the finding was treated as an emergency rather than a shrug.
That difference is the entire value proposition. Not perfection. A system where violations are rare, findable, reportable, and fixable, maintained by people who consider one counterexample a high-priority defect.
My rating, unchanged
I am not downgrading the borrow checker over this. I am downgrading anyone who told you it was mathematically incapable of error, because that was always a slightly bigger claim than the facts supported.
Use Rust. Run your sanitizers. Be a little skeptical of exotic lifetime code, especially the kind a model wrote for you at two in the morning. And when the next tool promises you safety, ask the question this story answers so well: if that promise were broken, would anybody be able to tell?
🕒 Published: