~64 AI agents rebuilt Bun in 11 days. Millions ran it for a month.
For a month, millions of machines have run a JavaScript runtime that AI agents rewrote into another language. Nobody noticed. That was the point.
The problem was never speed. It was memory.
Bun is a JavaScript runtime, and Claude Code's engine. The problem was never speed. It was memory. Bundle one project two thousand times. The old build climbs to six and a half gigabytes. The rewrite stays at six hundred megabytes.
It has been shipping inside Claude Code since June.
$ strings ~/.local/bin/claude | grep -m1 'Bun v1' Bun v1.4.0 (macOS arm64)
They ran it in eleven days, with about sixty agents at once. A million lines landed. It has shipped inside Claude Code since June. Run strings on the binary. It prints Bun version one point four. Bun never released it.
Nobody read a million lines. So they built a machine to check it.
// compiles clean, frees the same memory twice: StdioResult::Buffer(mut pipe) => { // pipe: Box<uv::Pipe>, handed to async uv_close pipe.close(Subprocess::on_pipe_close) // UAF, then double-free } // fix: leak the Box so libuv owns the handle Box::leak(pipe).close(Subprocess::on_pipe_close)
Nobody read a million lines. Nobody could. So the story isn't the writing. It's the checking. Bun's test suite is TypeScript. The rewrite couldn't touch it. One point four million assertions, sixty thousand tests, none skipped. Then the review. One agent writes the code. Two more see only the diff, not the writer's reasoning. They must assume the code is wrong. This code compiled cleanly. It frees the same memory twice. Rust was built to prevent that bug. A reviewer caught it by hand.
The argument isn't about Rust.
The pushback isn't really about Rust. Bun has belonged to Anthropic since December. There is still no published governance document. The tests pass. Nobody noticed for a month. Is that enough to trust a million lines nobody read?
Syntactically identical. Semantically different.
// argument runs in every build
assert(insertStale(src, false)
== refresh_index);
// whole line erased in release debug_assert!(insert_stale(src, false)? == refresh_index);
Nineteen regressions got through. Zig's assert is a function, so its argument always runs. Rust's is a macro, erased in release. That call registered files for hot reloading. So reloading broke in release builds only.
When a machine writes the code, the thing you review is the checker.
The part worth keeping has nothing to do with Rust. When a machine writes the code, the thing you review is the checker. They built that first.
