atheris

What it is and what it does

Atheris is a coverage-guided fuzzer that automatically generates and mutates test inputs to find bugs in Python code and native CPython extensions. It instruments Python bytecode to track code coverage, then uses that feedback to guide libFuzzer's mutation engine toward unexplored code paths. This approach makes it effective at discovering crashes, uncaught exceptions, and undefined behavior in both pure Python and C/C++ extension code.

The fuzzer works by defining a single entry point function (TestOneInput) that accepts raw bytes, then running it repeatedly with mutated inputs. You control which code gets instrumented—via context managers, decorators, or a blanket call—and can optionally enable hooks for regex and string methods. It integrates with coverage.py for visualization and supports custom mutators for grammar-aware fuzzing of complex data formats.

Use it for:

• Discover crashes and uncaught exceptions in Python code by fuzzing parsing or processing functions.
• Test native CPython extensions for memory safety bugs using Address Sanitizer or Undefined Behavior Sanitizer.
• Validate input handling in code by generating diverse, coverage-guided test cases.
• Fuzz complex data formats using custom mutators to generate valid inputs.
• Measure code coverage of fuzzing campaigns and identify untested code paths.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Atheris is a coverage-guided fuzzer for Python code and native CPython extensions, using libFuzzer to generate and mutate test inputs that maximize code coverage and expose bugs.

Yes, if you need automated bug detection in Python code or native extensions. Atheris is actively maintained, has no known vulnerabilities, and is well-suited for security testing and robustness validation. Install friction is moderate due to compiled dependencies, but prebuilt wheels ease setup for standard Python versions. Verify the license terms before use. Not necessary for basic unit testing, but valuable for finding edge-case bugs.

Install

atheris on PyPI

pip install atheris

uv add atheris

poetry add atheris

Installing atheris

Before you install

Medium install friction due to compiled dependencies. Prebuilt wheels are available for Python 3.11–3.14 on Linux and macOS, but fuzzing native extensions requires building from source with Clang and libFuzzer, which adds complexity. The package is actively maintained with recent releases.

License in practice

License treatment is unclear; no SPDX identifier or raw license text is available in the metadata. Verify the license terms at the GitHub repository before use in proprietary or restricted-license projects.

Quickstart

pip install atheris

import atheris
import sys

with atheris.instrument_imports():
  import sys

def TestOneInput(data):
  pass

atheris.Setup(sys.argv, TestOneInput)
atheris.Fuzz()

Requires Python 3.11–3.14 on Linux or macOS. Fuzzing native extensions requires Clang and libFuzzer; building from source may require downloading and building LLVM if your Clang version is too old.

Verify before relying

• Whether the license is compatible with your project's requirements (GitHub repo should clarify).
• Performance overhead of bytecode instrumentation on large codebases.
• Compatibility with third-party fuzzing frameworks or CI/CD systems.

Package facts

Evidence: atheris-3.1.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl; atheris-3.1.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl; atheris-3.1.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl

Tags

More Quality Assurance packages