---
title: "Fuzz every parser of untrusted input · Agent Wranglers"
url: https://agentwranglers.se/playbook/testing/non-functional-tests/fuzz-parsers
updated: 2026-10-20
licence: "All rights reserved"
---

# Fuzz every parser of untrusted input

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Non-functional tests](https://agentwranglers.se/playbook/testing/non-functional-tests)
- Rule: Feed generated and random input to every parser of outside data, and turn every crash into a regular test.
- How: Use a coverage-guided fuzzer on file, header and message parsers, such as Go's built-in `go test -fuzz`, cargo-fuzz for Rust or Jazzer for Java. Use property-based tests, such as Hypothesis or fast-check, to state rules that must hold for any input. Run the fuzzer for a fixed time in CI, such as five minutes with `-fuzztime=5m`, and keep the inputs that found bugs.
- Check: The fuzz job runs in CI for its set time and finds no crash. Every past crash input is stored and passes as a unit test.

Example:

```js
// fast-check: decoding what we encoded always gives the original back
import fc from 'fast-check';
fc.assert(fc.property(fc.string(), text => decode(encode(text)) === text));
```

```python
# Hypothesis
from hypothesis import given, strategies as st

@given(st.text())
def test_decoding_what_we_encoded_gives_it_back(text):
    assert decode(encode(text)) == text
```

```go
// Go native fuzzing
func FuzzRoundTrip(f *testing.F) {
    f.Add("hello")
    f.Fuzz(func(t *testing.T, text string) {
        if decode(encode(text)) != text {
            t.Fatalf("round trip changed %q", text)
        }
    })
}
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers testing playbook: https://agentwranglers.se/playbook/testing/non-functional-tests/fuzz-parsers`.

- Previous: [Grade AI features against fixed examples](https://agentwranglers.se/playbook/testing/non-functional-tests/llm-evals)
- [Non-functional tests](https://agentwranglers.se/playbook/testing/non-functional-tests)