Rust has become an attractive rewrite target for legacy apps because it can prevent many dangerous memory-safety bugs and provide low-level system control for critical workloads requiring real-time performance. AI can smooth what has been an arduous manual rewrite process, further boosting Rust's recent growth – but the conversion still requires close attention to application architecture.
Unlike older low-level programming languages, such as C and C++, Rust is both memory-safe and not garbage-collected. Memory safety means the language guarantees that it's impossible to write code containing memory errors, a common and dangerous category of bug – the same category of flaws that PHP2shell exploited last week, endangering 22 million servers.
Garbage collection is the process by which a program automatically manages memory. It is the most popular route to enforcing memory safety; Java, Python, JavaScript and Go all use garbage collection. However, it can introduce significant performance and memory footprint overhead.
Thus, Rust has also gained popularity for some performance-sensitive systems because of its rare combination of memory safety and low-level systems control.
"There are many languages that do one or the other, but Rust is essentially the only one that does both. Even if you hate everything else about Rust, this would be a reason to use it," wrote Adrian Sampson, a professor in the computer science department at Cornell, in an email to TechTarget.
Memory-safety bugs are an "incredibly pernicious and dangerous category of bugs," Sampson wrote.
"For example, a Microsoft study found at one point that about two-thirds of all the security-related bugs they reported in their software were memory-safety bugs," Sampson wrote.
In early September, Microsoft made Rust a Tier 1 language, which means it's one of the company's most supported languages for internal development.
The language is consistently rated by developers as "most-admired" in Stack Overflow's annual developer survey. "Rewrite it in Rust" (RIIR) has become a programmer meme, and a February 2024 report from the Biden administration made a case for porting to the language to build more secure critical software. Rust is also scheduled to become mandatory for building Git 3.0, which is set to take effect in April 2027.
37signals, the developer of the HEY email service, recently used AI agents to rewrite parts of HEY's backend in Rust.
"This is an awful, awful, awful programming language when you subject humans to write it," said David Heinemeier Hansson, co-owner and CTO of HEY developer 37signals, during his opening keynote at Rails World in September.
Hansson went on to praise Rust's performance benefits and the ability of AI agents to handle coding. "Agents like Rust. Great! What a division of labor: I'll tell you what to do; you write in Rust." He said that HEY's rewritten backend uses 99% less CPU and 95% less memory than the previous implementation.
AI can make Rust rewrites easier
The catch is that rewriting applications in Rust can be difficult due to the language's steep learning curve, prompting some teams to turn to LLMs to handle the grunt work and reap Rust's benefits.
Other companies, including Bun, Google and GitHub, have also undertaken Rust rewrites in recent months, and some of those recent converts have credited AI with easing an otherwise labor-intensive manual rewrite process.
David Strauss, chief product officer at Amutable, a security startup, said he had once questioned the value of switching to Rust. He didn't think the "juice was worth the squeeze," especially for rewrites.
"I have become much more of a Rust supporter as AI has evolved, because a lot of the challenge with Rust was like, 'Can I be productive enough in this language?'" Strauss said. "If I have AI writing it, especially with some of these modern frontier models, there's just so little overhead to working with Rust compared to working with other languages."
Strauss said that most of Amutable's software is written in Go or Rust because both are memory-safe languages, and the company focuses on security-related software.
"There are practical reasons why it might not be appropriate for some things, but if you're building software and shipping it to a cloud, you should really be using a memory-safe language at this point," Strauss said.
AI can't eliminate the challenges of Rust rewrites
It's important to be precise about what the language is good for and its limitations, said Rohini Ramegowda, a firmware engineer at Torus, a secure energy storage and management company.
Ramegowda worked on a production firmware migration from C to Rust in a previous role at a consumer appliance company, while transitioning from one microcontroller family to another.
The rewrite occurred before AI coding tools became widely available, but Ramegowda said AI would have helped with some aspects of the move.
"The application-layer porting would have been easier. AI would have handled the straightforward translation well. What it wouldn't have solved is the architecture problems. Those still need an engineer who understands the system," she said.
AI-driven migration also creates a "mountain of code review" that might not match system requirements. "The generation speeds up, but the verification doesn't," she said.
The generation speeds up, but the verification doesn't.
Rohini Ramegowda
Firmware engineer, Torus
But Rust itself didn't solve every problem, Ramegowda said. Memory bugs and stack overflows went away, but other system-level challenges persisted.
"If you don't do the architecture right, none of the languages [are] going to solve the problems," she said. "I'd be careful about giving the language all the credit."
During the rewrite, her team moved from a legacy C-based architecture to a Rust-based one that separated platform features from product-specific ones. That required untangling and reorganizing the codebase – an architectural problem.
Determinism was another problem that Rust did not completely solve, since "a memory-safe task that overruns its period has still failed," according to Ramegowda.
Rust was less familiar to compliance auditors as well.
"Safety work needs a qualified toolchain, and the certified Rust story is a lot younger than the certified C story, so you can rewrite, genuinely be safer and still end up further from passing an audit," Ramegowda said.
Limited Rust toolchain support can also complicate its adoption in software that runs across different platforms, Strauss said.
"When we've looked at using Rust for parts of systemd, we have to consider that systemd runs on embedded devices that don't always have full Rust toolchain support yet. Same thing for the Linux kernel," he said. Strauss is a co-maintainer of the Linux system and service manager project. "It has to run in a lot of places where there's not full Rust toolchain support yet, or they've had to create that support in order to make it work there."
AI might make translating C into Rust easier, but the resulting software still needs to run on the hardware and platforms its users depend on. Working around compatibility issues sometimes requires using code that can reintroduce security issues in a multi-language system, according to Ramegowda.
"You cannot dodge the interop question. You end up wrapping vendor C SDKs in unsafe blocks, so the guarantees hold in your code and stop at the boundary, which is exactly where the code you cannot see lives," Ramegowda said.
Rust also does not address other pertinent classes of security vulnerability, said Neil Carpenter, advisor at agentic security software maker Trent AI, based in London.
"[Rust is] not going to fix inadequate authentication and authorization. It's not going to fix every other class of security vulnerability," Carpenter said. "There's still lots of mistakes that developers can make that are as bad or worse than the handful of things that [Rust] abstracts away from. If you're not already good at the other things, then you're still going to be making all those other mistakes."
Ben Lutkevich is an award-winning writer for TechTarget.com.
