Why Bun, GitHub, Ubuntu and Cloudflare moved to Rust, and what the sceptics say

Bun, GitHub and Ubuntu all finished large Rust moves in 2026, and Cloudflare is porting the TypeScript compiler. The reasons they give are memory bugs, embedding and speed, and a rewrite bill that AI agents have cut from about a year of team time to days or weeks. Their own numbers also show where Rust doesn’t help.

The pattern is easier to read once you separate two kinds of move. Some projects swapped existing code for Rust. Others only wrote new code in it, and left the old code alone. Our Rust 1.100 report covers the language side.

Who has moved, and what they ported

Project	What moved	How
Bun	The whole runtime, 535,496 lines of Zig	All at once, 11 days, 64 Claude instances
GitHub Copilot runtime	TypeScript on Node to 832,378 lines of Rust	One piece per pull request, 14.5 weeks
Ubuntu	Rust uutils coreutils and sudo-rs replace GNU coreutils and sudo	Phased from 25.10, completed in 26.10
Cloudflare	FL2 proxy replaced NGINX and LuaJIT; tsrs ports the TypeScript compiler	Rewrite, plus a port with VoidZero
Discord	Desktop client moving off Electron to a Rust core	Announced by CTO Stanislav Vishnevskiy
Linux kernel	New drivers and subsystems	Rust beside C, no rewrite
Android	About five million lines of new Rust	New code only
Git	Rust becomes a mandatory build requirement in Git 3.0	Git 2.55 enables it by default

Microsoft sits in both camps. Mark Russinovich told Communications of the ACM in February that about 70% of the vulnerabilities Microsoft addresses relate to memory safety, and that Rust is the first choice for new systems that can’t tolerate a garbage collector. He added that this “doesn’t mean Rust everywhere.” Our Copilot Cowork report covers one Python to Rust move there.

Why they say they moved

Memory bugs. Bun creator Jarred Sumner wrote on 8 July that a large share of Bun’s bug list is use-after-free, double-free and “forgot to free” in error paths. “In safe Rust, these are compiler errors and RAII-like automatic cleanup with Drop,” he wrote. Sumner discloses that Anthropic acquired Bun in December 2025 and that he used a pre-release Claude model for the port.

Linux kernel maintainer Greg Kroah-Hartman said in Mumbai on 15 July that “the Rust experiment is over. It’s real.” He gave what he called a “totally unscientific” estimate that 80% of the kernel’s 25 years of CVEs would have been caught. Google’s Android team reports memory-safety bugs fell from 76% of vulnerabilities in 2019 to under 20% in 2025, and it calls the link to Rust a correlation.

Google’s write-up adds that Rust code shows about 0.2 vulnerabilities per million lines, against about 1,000 historically for C and C++. It also reports a rollback rate four times lower and 25% less review time.

Embedding and speed. Stephen Toub, a Distinguished Engineer at Microsoft, wrote on the GitHub blog on 17 September that the Copilot runtime had to embed in six SDKs through a C ABI without shipping Node and V8. He says GitHub moved “away from TypeScript and Node” rather than to Rust for its own sake, and that “the right target language legitimately varies from application to application.”

His benchmarks: a client, session and one turn dropped from 5.25 seconds to 292 milliseconds in-process, which is 18 times faster. Memory for ten clients fell from 1,383 MB to 126 MB, 91% lower. Cloudflare reports its Rust FL2 proxy uses less than half the CPU and much less than half the memory of the NGINX and LuaJIT system it replaced, and puts sites 10 milliseconds faster at the median.

The cost of rewriting fell. Sumner puts the Bun port at about US$165,000 at API pricing, against about three engineers for a year by hand. Toub puts the Copilot port at about US$120,000 in tokens plus roughly three weeks of his own time, where a team would previously have needed a year or two. The ts-rust README says its LLM-written TypeScript port burned over US$420,000 in tokens by list price, “probably ~$20k” in practice, and its author says he has never read a line of the code.

What went wrong

Sumner lists 19 known regressions in the Bun port, all fixed. Most were “syntactically identical in both languages but semantically different.” One placeholder constant dropped the interned-filename ceiling from 8.4 million to 270,272. About 4% of the Rust sits in unsafe blocks. He also reports the port fixed 128 bugs that reproduced in Bun 1.3.14.

Toub answers the question of whether AI-written Rust compiles into trouble with data. Of 8,678 compiler errors in the port, 84% came from four ordinary families: name resolution at 37%, missing methods or fields at 22%, type mismatch at 14% and trait bounds at 11%. Ownership, borrowing and lifetimes made up only 1.7%. The compiler gave the agents a fast feedback loop, but he reports dozens of regressions by 14 September, and every one of them compiled and merged. “‘If it compiles, it’s correct’ is useful only as a joke,” he wrote. He lists three lessons: end-to-end tests are critical, the agent must not be able to edit the oracle, and you translate first and redesign second.

Ubuntu’s experience matches. A Zellic audit of uutils and sudo-rs found 113 issues in two phases, and heise and corrode count 44 CVEs. Matthias Endler of corrode wrote in April that the borrow checker, clippy and cargo audit caught none of the examples he studied, including a kill -1 bug (CVE-2026-35369) and a local root hole in chroot (CVE-2026-35368). Ubuntu 26.04 LTS held back cp, df, mv, rm and true. Jon Seager, Canonical’s VP of Ubuntu Engineering, said Canonical couldn’t prove the esoteric uses were safe (“we can’t prove it”), and that switching back to GNU is easy.

What the sceptics say

Linus Torvalds told Open Source Summit India: “I’m not sure Rust is going to take over the world.” He added that “Rust fixes a few easy bugs that you can make in C, but it does not fix the logic errors,” and that “the guarantees that Rust give you only apply in the Rust-only parts of your code base, and wherever you interact with C code, all bets are off.”

Even Rust’s kernel advocate is cautious. Kroah-Hartman said “Rust will still crash just fine,” that kernel maintainers “optimize for reviewers,” and that “we don’t want rewrites… leave existing C code alone.” Android’s own documentation says rewriting all memory-unsafe code, over 70% of the platform, isn’t feasible. Christoph Hellwig compared mixing Rust and C to “cancer” in February 2025, according to The Register.

Zig creator Andrew Kelley argued on 9 July that if Bun’s test suite couldn’t catch its Zig bugs, it’s an open question why that suite is enough for a million lines of unreviewed Rust. He also says LTO was always available in Zig, and that Bun published no compile-time numbers, noting the Zig compiler’s own clean build takes 16 seconds.

The TypeScript team picked Go for its native compiler. Its maintainers wrote in a March 2025 discussion that “many languages would be suitable in a ground-up rewrite situation,” but a port needed a structurally similar codebase. Cloudflare’s tsrs, built with VoidZero and Max Schwenk of Owner.com with the TypeScript team’s collaboration, claims up to 8 times the speed and about 70% less memory than TypeScript 7.0.

Microsoft’s Galen Hunt posted that the company would “eliminate every line of C and C++” by 2030, with “1 engineer, 1 month, 1 million lines.” Microsoft later clarified that “Windows is *NOT* being rewritten in Rust with AI” and that the project is research, according to ITPro. JetBrains’ August review lists failed Rust attempts at Prisma, curl with hyper and Loglog Games, and recommends incremental adoption.

Bun’s Rust build is in canary as v1.4.0, and Sumner gives no stable date. Git hasn’t set a date for 3.0. Toub says redesign comes after the port, and Bun says it will refactor towards idiomatic Rust after v1.4.