DARPA AIxCC cyber reasoning systems: Atlantis, Buttercup, RoboDuck, ARTIPHISHELL, open-sourced 2025
================================================================================

The seven finalists of DARPA's AI Cyber Challenge, all open-sourced after the August 2025 final. They combine LLMs with fuzzing and program analysis to find and patch bugs in C and Java, processed 54 million lines of code in the final, found 18 real zero-days and patched 43 of 54 synthetic bugs. OpenSSF's OSS-CRS packages them for open-source maintainers.

Atlantis: Team Atlanta (Georgia Tech, Samsung Research, KAIST, POSTECH) — C, Java — Ensemble of independent bug-finding modules sharing seeds, with eight patching agents — Open-sourced after the 2025-08-08 final
Buttercup: Trail of Bits — C, Java — LLM plus fuzzing plus program analysis using non-reasoning models; finds and patches — Open-sourced 2025
RoboDuck: Theori — C, Java — LLM-only pipeline with no fuzzing or symbolic execution — Open-sourced 2025
OSS-CRS and other AIxCC finalists: OpenSSF and the AIxCC finalist teams — C, Java, OSS-Fuzz projects — Packaging of finalist components (Shellphish ARTIPHISHELL, 42-b3yond-6ug BugBuster, all-you-need-is-a-fuzzing-brain, Lacrosse) for open-source maintainers — Active
How to choose: Cheapest self-hosted starting point: **Buttercup** (Trail of Bits). | Highest real-world bug count in the final: **Atlantis** (Team Atlanta). | Study of what LLMs alone can do without fuzzing: **RoboDuck** (Theori). | Integrated distribution for maintainers: OpenSSF **OSS-CRS**.

Source page: https://agentsast.com/categories/aixcc/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13