How one developer used Claude to build a memory-safe extension of C
(2026/01/26)
- Reference: 1769463013
- News link: https://www.theregister.co.uk/2026/01/26/trapc_claude_c_memory_safe_robin_rowe/
- Source link:
feature TrapC, a memory-safe version of the C programming language, is almost ready for testing.
"We're almost there," Robin Rowe told The Register in a phone interview. "It almost works."
We caught up with Rowe, a computer science professor and entrepreneur, amid debugging efforts that had kept him up until four in the morning. The long-awaited [1]TrapC website has appeared.
[2]
"My work building TrapC has taken two parallel paths," Rowe explains in his initial post. "A TrapC interpreter called itrapc and a separate compiler called trapc. I had wanted to make a software release by 1 January 2026, but too many bugs. I only reached code complete this month and am now on the painstaking and sleepless process of debugging. When I have something stable that mostly works I will make a release. Sorry to make you wait a little longer. Aiming for Q1 2026."
[3]
[4]
Back in November 2024, Rowe explained that he was working on [5]TrapC . At the time, the public and private sector had undertaken a campaign to promote memory-safe software development as a way to reduce exposure to serious vulnerabilities.
[6]Memory safety provides a way of ensuring that memory-related bugs like out-of-bounds reads/writes and use-after-free don't happen. In large codebases, like Chromium and Windows, most of the security vulnerabilities follow from memory bugs. As that message has been repeated in recent years, memory safety has become an imperative, evangelized by the likes of Google and Microsoft, and more recently by [7]authorities in the US and elsewhere.
[8]
For at least the past ten years, there's been a rising chorus of voices calling for the [9]adoption of memory-safe programming languages and techniques. This has meant encouraging developers to avoid languages like C and C++ where feasible, and to adopt languages like C#, Go, Java, Python, Swift, and Rust, instead, particularly for new projects.
To remain relevant, the C and C++ communities have tried to address those concerns with projects like [10]TrapC , [11]FilC , [12]Mini-C , [13]Safe C++ , and [14]C++ Profiles . There's also a C to Rust conversion project under development at DARPA called [15]TRACTOR – TRanslating All C TO Rust.
But progress has been slow and those writing in C and C++ haven't found a widely accepted approach. The C++ standards committee recently [16]rejected the Safe C++ proposal. And Rowe said he doubted TRACTOR would have anything to show this year.
[17]
Meanwhile, the clock is ticking. Microsoft engineer Galen Hunt last month [18]said , "My goal is to eliminate every line of C and C++ from Microsoft by 2030. Our strategy is to combine AI and algorithms to rewrite Microsoft's largest codebases."
How he's using AI tools
"There are some efforts to port C code by hand to Rust," said Rowe. "But there're some real challenges to doing that because there are some idioms in C that cannot be expressed in Rust.
"Rust is much more type safe than C is. And so if you have a void pointer, what does that mean in Rust? There's no translation for it. And that's how TrapC is fundamentally different because it actually remembers what that void pointer actually is."
Rowe said he expects TRACTOR will eventually be able to accomplish C to Rust translation using AI. But he said he thinks it's better to just build the necessary tooling into the C compiler, so you don't have to rely on some external tool that rewrites your code in an unfamiliar language.
Rowe has been using AI tools himself and has been teaching others to do so. This past semester, he taught AI Cybersecurity Programmer Analyst (PCO471) at Community College of Baltimore County – Linux administration using vibe coding in bash with no prerequisites. And starting in February, he's teaching C++ Programming with Generative AI ( [19]PCO472 ) – vibe coding in C++.
Rowe said programming has fundamentally changed as a result of AI tools. "I think this is sort of the same type of discussion as when C came in and people said, 'Well, I'm happy in assembly.' There will still be people doing it the old way. But because vibe programming is so much more efficient on time when done correctly, there's gonna be no choice. You just won't be competitive if you're not vibe programming."
Then he shifted gears, slightly. "But I have to walk that back a little bit because the reason I was up until four in the morning is I had vibe programming working on the Trap C compiler. And it took a fundamentally wrong design turn. And I didn't detect that it had made a design mistake. I had told it how I wanted to approach it. But somehow it misunderstood me or it forgot or something happened and I forgot to check. And so I spent hours doodling around in the debugger and trying to understand why code was acting weird before I finally looked at it and said, 'wait a minute, this isn't even the right design.'"
Rowe said a similar situation crops up in pair programming, where you've told someone to do something and they didn't do it, and you don't realize that until later.
"[C++ creator] Bjarne Stroustrup famously said that the most important thing in software design is to be clear about what you're trying to build," Rowe said. "And vibe [programming] just puts that on steroids. Now we not only have to be ourselves clear, but we have to communicate it clearly to an LLM."
[20]Cursor used agents to write a browser, proving AI can write shoddy code at scale
[21]eBay updates legalese to ban AI-powered shop-bots
[22]AI hasn't delivered the profits it was hyped for, says Deloitte
[23]House GOP wants final say on AI chip exports after Trump gives Nvidia a China hall pass
Rowe argues that developers have to be encouraged to try AI tools and to make mistakes. He recounted how during his AI Cybersecurity Programmer Analyst course, his students expressed interest in doing more hands-on work in lieu of lectures.
"So I said, 'I've got real servers on the internet that are my companies. I'll give you root,'" he recalled. "I'll set loose students who know nothing on my own servers and hope for the best and we'll see how this goes. And the reaction was panic. I couldn't get past the timidity cliff."
Rowe said that what he learned from that exchange was that they didn't want their own hands-on, they wanted to watch him work.
"I said to them, 'But guys, this is like learning to play the piano. You can't learn to play the piano by watching me. Yeah, you guys have to practice. And it's gonna be embarrassing at first. You know, you're gonna play a lot of bad notes and sound terrible. You have to get over that situation'."
That's a scenario playing out in various companies where AI tools [24]remain underutilized , for various reasons, including lack of training, security concerns, lack of utility, and poor tool design.
China vs the US
Rowe has traveled often to China to speak at the China Association of Higher Education conference. In December, he said, he was interviewed on China News Television about how China's plan for AI compares with America's.
In an email he explained, "I said, 'China's AI-Plus plan calls for efficient AI on devices everywhere, from farm to factory to city, while the White House plan calls for building 500-billion-dollar cloud data centers ... using chips that will, inevitably, seem obsolete within two years.'"
Rowe argues China's approach will prevail and that the US has taken the wrong turn by focusing on centralized cloud datacenters to run LLMs. Within two years, he said, we'll have AI models we can run locally on our phones, with no need for network access for most tasks. Apple and Huawei, he said, are likely to be the winners in this scenario.
Rowe pointed to China's DeepSeek as an example. While it may not be quite as good as the leading US commercial models, he said, it runs with far less power.
"This is a very Moore's Law type of strategy," he said. "I remember when I had a Navy supercomputer in 1994. That was an amazing technology. But in 1995, Cray went bankrupt. There weren't enough buyers for it, even though it was an amazing device.
"And now I've got an iPhone that's in my pocket. That runs on a battery. It doesn't have a whole room devoted to it and exotic cooling and all kinds of stuff. And it's more powerful than that [the Cray from 1994]. So as a long-term strategy, you know, going toward the device makes a lot more sense, because that half-trillion dollar data center is going to be on my iPhone eventually."
Rowe also said that on the recommendation of a friend from his time at the AT&T DIRECTV Innovation Lab, he tried running Deepseek at a time when Claude wasn't available. Deepseek, he said, was able to find a bug that Claude couldn't.
"Surprisingly, the bug was in code Claude had generated, that I had cut-and-pasted carelessly," he said. "With hindsight it was a silly code mistake I should have caught, but was in an 'else' branch outside where I was looking. I'd not expected or intended to have Claude make any change to that block of code. And because the code was valid but the logic wrong, the compiler didn't catch it."
But the bug was obvious, he said, as soon as Deepseek pointed it out. He added, "I'm paying $200/year for Claude. Deepseek is free." ®
Get our [25]Tech Resources
[1] https://trapc.org/index.php/2026/01/26/hello-world/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aXfyH6jWe42KKeGUy_9bsQAAAYs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aXfyH6jWe42KKeGUy_9bsQAAAYs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aXfyH6jWe42KKeGUy_9bsQAAAYs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2024/11/12/trapc_memory_safe_fork/
[6] https://www.memorysafety.org/docs/memory-safety/
[7] https://www.theregister.com/2025/06/27/cisa_nsa_call_formemory_safe_languages/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aXfyH6jWe42KKeGUy_9bsQAAAYs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://alexgaynor.net/2017/nov/20/a-vulnerability-by-any-other-name/
[10] https://trapc.org/index.php/2026/01/26/hello-world/
[11] https://www.theregister.com/2024/11/16/rusthaters_unite_filc/
[12] https://www.theregister.com/2025/01/03/mini_c_microsoft_inria/
[13] https://www.theregister.com/2024/09/16/safe_c_plusplus/
[14] https://github.com/BjarneStroustrup/profiles
[15] https://www.theregister.com/2024/08/03/darpa_c_to_rust/
[16] https://www.theregister.com/2025/09/16/safe_c_proposal_ditched/
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aXfyH6jWe42KKeGUy_9bsQAAAYs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[18] https://www.linkedin.com/posts/galenh_principal-software-engineer-coreai-microsoft-activity-7407863239289729024-WTzf/
[19] https://www.ccbcmd.edu/Programs-and-Courses-Finder/course/PCO/472.html
[20] https://www.theregister.com/2026/01/22/cursor_ai_wrote_a_browser/
[21] https://www.theregister.com/2026/01/22/ebay_updates_legalese_to_ban/
[22] https://www.theregister.com/2026/01/21/deloitte_enterprises_adopting_ai_revenue_lift/
[23] https://www.theregister.com/2026/01/21/house_gop_ai_chip_exports_trump_china_nvidia/
[24] https://www.theregister.com/2026/01/21/deloitte_enterprises_adopting_ai_revenue_lift/
[25] https://whitepapers.theregister.com/
"We're almost there," Robin Rowe told The Register in a phone interview. "It almost works."
We caught up with Rowe, a computer science professor and entrepreneur, amid debugging efforts that had kept him up until four in the morning. The long-awaited [1]TrapC website has appeared.
[2]
"My work building TrapC has taken two parallel paths," Rowe explains in his initial post. "A TrapC interpreter called itrapc and a separate compiler called trapc. I had wanted to make a software release by 1 January 2026, but too many bugs. I only reached code complete this month and am now on the painstaking and sleepless process of debugging. When I have something stable that mostly works I will make a release. Sorry to make you wait a little longer. Aiming for Q1 2026."
[3]
[4]
Back in November 2024, Rowe explained that he was working on [5]TrapC . At the time, the public and private sector had undertaken a campaign to promote memory-safe software development as a way to reduce exposure to serious vulnerabilities.
[6]Memory safety provides a way of ensuring that memory-related bugs like out-of-bounds reads/writes and use-after-free don't happen. In large codebases, like Chromium and Windows, most of the security vulnerabilities follow from memory bugs. As that message has been repeated in recent years, memory safety has become an imperative, evangelized by the likes of Google and Microsoft, and more recently by [7]authorities in the US and elsewhere.
[8]
For at least the past ten years, there's been a rising chorus of voices calling for the [9]adoption of memory-safe programming languages and techniques. This has meant encouraging developers to avoid languages like C and C++ where feasible, and to adopt languages like C#, Go, Java, Python, Swift, and Rust, instead, particularly for new projects.
To remain relevant, the C and C++ communities have tried to address those concerns with projects like [10]TrapC , [11]FilC , [12]Mini-C , [13]Safe C++ , and [14]C++ Profiles . There's also a C to Rust conversion project under development at DARPA called [15]TRACTOR – TRanslating All C TO Rust.
But progress has been slow and those writing in C and C++ haven't found a widely accepted approach. The C++ standards committee recently [16]rejected the Safe C++ proposal. And Rowe said he doubted TRACTOR would have anything to show this year.
[17]
Meanwhile, the clock is ticking. Microsoft engineer Galen Hunt last month [18]said , "My goal is to eliminate every line of C and C++ from Microsoft by 2030. Our strategy is to combine AI and algorithms to rewrite Microsoft's largest codebases."
How he's using AI tools
"There are some efforts to port C code by hand to Rust," said Rowe. "But there're some real challenges to doing that because there are some idioms in C that cannot be expressed in Rust.
"Rust is much more type safe than C is. And so if you have a void pointer, what does that mean in Rust? There's no translation for it. And that's how TrapC is fundamentally different because it actually remembers what that void pointer actually is."
Rowe said he expects TRACTOR will eventually be able to accomplish C to Rust translation using AI. But he said he thinks it's better to just build the necessary tooling into the C compiler, so you don't have to rely on some external tool that rewrites your code in an unfamiliar language.
Rowe has been using AI tools himself and has been teaching others to do so. This past semester, he taught AI Cybersecurity Programmer Analyst (PCO471) at Community College of Baltimore County – Linux administration using vibe coding in bash with no prerequisites. And starting in February, he's teaching C++ Programming with Generative AI ( [19]PCO472 ) – vibe coding in C++.
Rowe said programming has fundamentally changed as a result of AI tools. "I think this is sort of the same type of discussion as when C came in and people said, 'Well, I'm happy in assembly.' There will still be people doing it the old way. But because vibe programming is so much more efficient on time when done correctly, there's gonna be no choice. You just won't be competitive if you're not vibe programming."
Then he shifted gears, slightly. "But I have to walk that back a little bit because the reason I was up until four in the morning is I had vibe programming working on the Trap C compiler. And it took a fundamentally wrong design turn. And I didn't detect that it had made a design mistake. I had told it how I wanted to approach it. But somehow it misunderstood me or it forgot or something happened and I forgot to check. And so I spent hours doodling around in the debugger and trying to understand why code was acting weird before I finally looked at it and said, 'wait a minute, this isn't even the right design.'"
Rowe said a similar situation crops up in pair programming, where you've told someone to do something and they didn't do it, and you don't realize that until later.
"[C++ creator] Bjarne Stroustrup famously said that the most important thing in software design is to be clear about what you're trying to build," Rowe said. "And vibe [programming] just puts that on steroids. Now we not only have to be ourselves clear, but we have to communicate it clearly to an LLM."
[20]Cursor used agents to write a browser, proving AI can write shoddy code at scale
[21]eBay updates legalese to ban AI-powered shop-bots
[22]AI hasn't delivered the profits it was hyped for, says Deloitte
[23]House GOP wants final say on AI chip exports after Trump gives Nvidia a China hall pass
Rowe argues that developers have to be encouraged to try AI tools and to make mistakes. He recounted how during his AI Cybersecurity Programmer Analyst course, his students expressed interest in doing more hands-on work in lieu of lectures.
"So I said, 'I've got real servers on the internet that are my companies. I'll give you root,'" he recalled. "I'll set loose students who know nothing on my own servers and hope for the best and we'll see how this goes. And the reaction was panic. I couldn't get past the timidity cliff."
Rowe said that what he learned from that exchange was that they didn't want their own hands-on, they wanted to watch him work.
"I said to them, 'But guys, this is like learning to play the piano. You can't learn to play the piano by watching me. Yeah, you guys have to practice. And it's gonna be embarrassing at first. You know, you're gonna play a lot of bad notes and sound terrible. You have to get over that situation'."
That's a scenario playing out in various companies where AI tools [24]remain underutilized , for various reasons, including lack of training, security concerns, lack of utility, and poor tool design.
China vs the US
Rowe has traveled often to China to speak at the China Association of Higher Education conference. In December, he said, he was interviewed on China News Television about how China's plan for AI compares with America's.
In an email he explained, "I said, 'China's AI-Plus plan calls for efficient AI on devices everywhere, from farm to factory to city, while the White House plan calls for building 500-billion-dollar cloud data centers ... using chips that will, inevitably, seem obsolete within two years.'"
Rowe argues China's approach will prevail and that the US has taken the wrong turn by focusing on centralized cloud datacenters to run LLMs. Within two years, he said, we'll have AI models we can run locally on our phones, with no need for network access for most tasks. Apple and Huawei, he said, are likely to be the winners in this scenario.
Rowe pointed to China's DeepSeek as an example. While it may not be quite as good as the leading US commercial models, he said, it runs with far less power.
"This is a very Moore's Law type of strategy," he said. "I remember when I had a Navy supercomputer in 1994. That was an amazing technology. But in 1995, Cray went bankrupt. There weren't enough buyers for it, even though it was an amazing device.
"And now I've got an iPhone that's in my pocket. That runs on a battery. It doesn't have a whole room devoted to it and exotic cooling and all kinds of stuff. And it's more powerful than that [the Cray from 1994]. So as a long-term strategy, you know, going toward the device makes a lot more sense, because that half-trillion dollar data center is going to be on my iPhone eventually."
Rowe also said that on the recommendation of a friend from his time at the AT&T DIRECTV Innovation Lab, he tried running Deepseek at a time when Claude wasn't available. Deepseek, he said, was able to find a bug that Claude couldn't.
"Surprisingly, the bug was in code Claude had generated, that I had cut-and-pasted carelessly," he said. "With hindsight it was a silly code mistake I should have caught, but was in an 'else' branch outside where I was looking. I'd not expected or intended to have Claude make any change to that block of code. And because the code was valid but the logic wrong, the compiler didn't catch it."
But the bug was obvious, he said, as soon as Deepseek pointed it out. He added, "I'm paying $200/year for Claude. Deepseek is free." ®
Get our [25]Tech Resources
[1] https://trapc.org/index.php/2026/01/26/hello-world/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aXfyH6jWe42KKeGUy_9bsQAAAYs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aXfyH6jWe42KKeGUy_9bsQAAAYs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aXfyH6jWe42KKeGUy_9bsQAAAYs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2024/11/12/trapc_memory_safe_fork/
[6] https://www.memorysafety.org/docs/memory-safety/
[7] https://www.theregister.com/2025/06/27/cisa_nsa_call_formemory_safe_languages/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aXfyH6jWe42KKeGUy_9bsQAAAYs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://alexgaynor.net/2017/nov/20/a-vulnerability-by-any-other-name/
[10] https://trapc.org/index.php/2026/01/26/hello-world/
[11] https://www.theregister.com/2024/11/16/rusthaters_unite_filc/
[12] https://www.theregister.com/2025/01/03/mini_c_microsoft_inria/
[13] https://www.theregister.com/2024/09/16/safe_c_plusplus/
[14] https://github.com/BjarneStroustrup/profiles
[15] https://www.theregister.com/2024/08/03/darpa_c_to_rust/
[16] https://www.theregister.com/2025/09/16/safe_c_proposal_ditched/
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aXfyH6jWe42KKeGUy_9bsQAAAYs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[18] https://www.linkedin.com/posts/galenh_principal-software-engineer-coreai-microsoft-activity-7407863239289729024-WTzf/
[19] https://www.ccbcmd.edu/Programs-and-Courses-Finder/course/PCO/472.html
[20] https://www.theregister.com/2026/01/22/cursor_ai_wrote_a_browser/
[21] https://www.theregister.com/2026/01/22/ebay_updates_legalese_to_ban/
[22] https://www.theregister.com/2026/01/21/deloitte_enterprises_adopting_ai_revenue_lift/
[23] https://www.theregister.com/2026/01/21/house_gop_ai_chip_exports_trump_china_nvidia/
[24] https://www.theregister.com/2026/01/21/deloitte_enterprises_adopting_ai_revenue_lift/
[25] https://whitepapers.theregister.com/
Re: Consequences, anyone??
VoiceOfTruth
>> But how many others will be using "vibe programming"................and just shipping the result without looking?
We already have the problem of compromised packages for Python and JavaScript, even straightforward ones, which 'developers' blinding install. The word developer covers the whole spectrum of abilities. But it's the widespread 'find it online, download and use it' methodology which worries me.
Consequences, anyone??
Quote: Robin Rowe "was up until four in the morning [as] I had vibe programming working on the Trap C compiler. And it took a fundamentally wrong design turn...."
Plaudits to Robin Rowe.
But how many others will be using "vibe programming"................and just shipping the result without looking?
Almost everyone!!
And "almost everyone else" will have to take the consequences!!!!