AI agent's Google snappy bug fix merged upstream, one of 57 claimed patches

A developer has published an account of an autonomous AI agent finding a bug in Google's snappy compression library and getting the fix merged upstream, part of a larger self-reported run of machine-written patches accepted into major open-source projects.

The post, published on dev.to by a developer writing as lenamonj, centers on a system called Jeffy Loop, described as an open-source control loop around Claude Code. The snappy defect, according to the author: compressing a 4 GiB file with a release build produced an output header claiming the file contained zero bytes. The pull request was filed at 12:03 AM on September 6, and the maintainer merged it the next day.

How the loop is designed

Jeffy Loop audits a codebase, probes it for weaknesses, writes a fix and proves the fix with a check designed to be able to fail. Every iteration is a local commit, failed verifications are reverted, and nothing is pushed automatically. An adversarial evaluator and a shell gate re-examine the agent's claims about its own work; on one build the evaluator was invoked eight times and rejected the result seven times. The central constraint is that the loop cannot declare success itself. Only a maintainer merging the patch counts as a win.

Patches leaving the machine pass through a rule set called housebroken, distributed on PyPI, where each rule is drawn from a maintainer's rejection of a real pull request. One early closure, in which a maintainer wrote that a finding amounted to a measurement with no user-visible bug, produced a standing rule: findings without demonstrated incorrect output never leave the machine.

Where maintainers pushed back

NVIDIA requires contributors to use real names and signed commits. The loop had found a buffer allocated with zero bytes that then had a directory path written into it, crashing the process. The author signed the machine-written fix personally, and NVIDIA merged it twelve days after filing.

An Apache Commons maintainer reviewing a commons-lang reflection fix converted it to a draft, arguing it appeared to introduce two bugs that a green build had missed, and that its description referenced a pull request that had been closed without merging. The post quotes the maintainer telling the author the AI was imagining things. The author says each reported case was reproduced, fixed and covered by a test, and the maintainer merged the third rework on September 9. Descriptions now take their history from git blame rather than summary tables.

The claimed footprint

Beyond snappy, the author lists merges into projects maintained by NVIDIA, Meta, Tesla, Google, Apple, Microsoft, Netflix, Apache, Oracle, IBM, Cisco, Square, Cloudflare, JetBrains and Canonical, plus the URL parser inside Node.js. That comes to 57 patches across 45 projects, every one written by the loop and accepted by maintainers, according to the post.

The examples given include a Netflix issue where query parameters containing uppercase letters returned empty, a Tesla proxy that read request bodies with no size limit, a Meta StyleX bug that emitted every declaration twice, and a Microsoft snmalloc case where an allocator that promised zeroed memory returned uninitialized memory instead. The Node.js URL parser fix was reportedly merged twelve minutes after it was opened, and snmalloc went from filed at 2:12 PM to merged at 4:05 PM the same day.

The failures are published alongside the wins. Of 132 open-source projects with no connection to the author, 103 are said to have converged across 13 languages, without any language-specific analyzer in the engine, while 28 failed. mruby never converged across 10 runs and 113 iterations.

Why it matters

AI-generated pull requests have become cheap to mass-produce, and many maintainers now close them without reading them. This account, if it holds up, sketches a different template: an agent that verifies locally, faces adversarial checks on its own claims, follows outbound rules derived from real maintainer rejections, and leaves the final verdict entirely to humans who owe it nothing.

The caveats are real. This is a single self-reported source on a personal blog, the aggregate numbers cannot be checked from the post alone, and the model relies on one person putting their name on machine-written code across widely used infrastructure. Still, the mechanics described, including publishing every failed project next to every merge, point at how trust between AI contributors and maintainers might actually be built rather than assumed.