Fuzz testing is a security testing method that sends unexpected, malformed, or randomly generated inputs into software to see how it breaks. Instead of only checking normal use cases, it probes edge cases such as bad types, oversized values, missing fields, and weird encoding. The goal is to uncover crashes, parsing bugs, memory errors, and validation failures before attackers do.
It matters because many real-world exploits begin with faulty input handling. In web services, APIs, parsers, and AI tool servers, a single unchecked argument can lead to denial of service, data corruption, or unsafe command execution. Defenders use fuzzing to harden software, especially at trust boundaries where untrusted data becomes executable logic. In agentic AI systems, fuzz testing is useful for testing tool invocation and schema validation, because model output must be treated like any other untrusted input.