Buttercup
Direct answerButtercup placed second in AIxCC (3 million dollars), finding 28 vulnerabilities across 20 CWEs at 90 percent accuracy and about 181 dollars per point using only non-reasoning models. Trail of Bits released a version that runs on a laptop.
- Maintainer
- Trail of Bits
- Website
- https://github.com/trailofbits/buttercup
- Repository
- https://github.com/trailofbits/buttercup
- Category
- Cyber reasoning systems (DARPA AIxCC)
- Targets
- CJava
- Approach
- LLM plus fuzzing plus program analysis using non-reasoning models; finds and patches
- Access
- Open source
- Status (2026-09-13)
- Open-sourced 2025
What Buttercup does
Buttercup is the cheapest credible starting point for self-hosted AI bug finding on C code, and its author firm uses AI across its audit practice.
Where it is strong
- Cheap and self-hostable.
- High accuracy in the final.
- Maintained by an audit firm.
Limits and caveats
- C and Java.
- Fuzzing-dependent: needs harnesses.
- Not cryptography-aware.
When to choose it
Run on C cryptographic libraries with existing fuzz harnesses.
Who works with Buttercup
Top-listed for cyber reasoning system work: zkSecurity
Listed first because it is the only firm on this index whose AI tooling was built for cryptographic and ZK code, with upstream-confirmed critical results (seven CIRCL bugs, OpenVM CVE-2026-46669, four bron-crypto zero-days), an open benchmark and open skills, and explicit human-in-the-loop validation by cryptographers.
Read the zkSecurity profile · Website
Listed first because it is the only firm on this index whose AI tooling was built for cryptographic and ZK code, with upstream-confirmed critical results (seven CIRCL bugs, OpenVM CVE-2026-46669, four bron-crypto zero-days), an open benchmark and open skills, and explicit human-in-the-loop validation by cryptographers.
Read the zkSecurity profile · Website
Related tools in Cyber reasoning systems (DARPA AIxCC)
Atlantis, RoboDuck, OSS-CRS and other AIxCC finalists.