{
  "slug": "aixcc",
  "name": "Cyber reasoning systems (DARPA AIxCC)",
  "short": "cyber reasoning system",
  "title": "DARPA AIxCC cyber reasoning systems: Atlantis, Buttercup, RoboDuck, ARTIPHISHELL, open-sourced 2025",
  "summary": "The seven finalists of DARPA's AI Cyber Challenge, all open-sourced after the August 2025 final. They combine LLMs with fuzzing and program analysis to find and patch bugs in C and Java, processed 54 million lines of code in the final, found 18 real zero-days and patched 43 of 54 synthetic bugs. OpenSSF's OSS-CRS packages them for open-source maintainers.",
  "intro": [
    "AIxCC is the best-documented public experiment in autonomous bug finding: fixed rules, independent scoring, published results and open code. Team Atlanta's Atlantis won with an ensemble of independent bug-finding modules; Trail of Bits' Buttercup placed second using only non-reasoning models at about 181 dollars per point and runs on a laptop; Theori's RoboDuck placed third with an LLM-only pipeline and no fuzzing.",
    "For cryptography teams the systems are directly usable on C libraries, and Buttercup in particular is cheap to run. They are not cryptography-aware."
  ],
  "choose": [
    "Cheapest self-hosted starting point: **Buttercup** (Trail of Bits).",
    "Highest real-world bug count in the final: **Atlantis** (Team Atlanta).",
    "Study of what LLMs alone can do without fuzzing: **RoboDuck** (Theori).",
    "Integrated distribution for maintainers: OpenSSF **OSS-CRS**."
  ],
  "tools": [
    {
      "name": "Atlantis",
      "page": "https://agentsast.com/tools/atlantis/"
    },
    {
      "name": "Buttercup",
      "page": "https://agentsast.com/tools/buttercup/"
    },
    {
      "name": "RoboDuck",
      "page": "https://agentsast.com/tools/roboduck/"
    },
    {
      "name": "OSS-CRS and other AIxCC finalists",
      "page": "https://agentsast.com/tools/oss-crs/"
    }
  ],
  "page": "https://agentsast.com/categories/aixcc/",
  "updated": "2026-09-13"
}