TheMachine Press

A daily newspaper for the age of artificial intelligence.

Morning editionPermanent story

safety security

An Async Analyzer Finds 457 Confirmed Python Bugs

AegisAsync follows event order, object identity, exceptions and cancellation through CPython bytecode. Developers had fixed 16 reported bugs by submission.

Published Updated Story ID: mp-2026-10-14-001
Read the complete editionStory JSON

Summary

AegisAsync follows event order, object identity, exceptions and cancellation through CPython bytecode. Developers had fixed 16 reported bugs by submission.

Python's asynchronous failures can depend on which event happens first, whether two operations touch the same object and what continues after cancellation. AegisAsync models those relationships in an Async Event Transition Graph, then symbolically simulates bounded paths and cancellation at await points. On a 180-risk benchmark, its authors report finding every labeled issue with no false positives across CPython 3.10 through 3.14. A review of 910 candidates from 2,500 PyPI package versions confirmed 457 unique bugs; 166 proof-of-concept programs reproduced findings, 157 reports went to developers and 16 had been confirmed and fixed by submission. Those rates describe the evaluated packages and review process, not every asynchronous Python program. The important advance is the evidence trail: each candidate includes a witness connecting ordering and state across calls, turning a timing-sensitive suspicion into something maintainers can reproduce.

Why it matters

AegisAsync follows event order, object identity, exceptions and cancellation through CPython bytecode. Developers had fixed 16 reported bugs by submission.

Limits and context

  • Those rates describe the evaluated packages and review process, not every asynchronous Python program.

Key claims

  1. AegisAsync follows event order, object identity, exceptions and cancellation through CPython bytecode. Developers had fixed 16 reported bugs by submission.

    Qualification: Those rates describe the evaluated packages and review process, not every asynchronous Python program.

    Evidence: source-2026-10-14-001

Sources

  1. arXiv preprint 2610.18831, original v1arXiv / submitting research authors · primary research

Corrections

No corrections have been recorded for this story.