{
  "slug": "buttercup",
  "name": "Buttercup",
  "tagline": "Trail of Bits' laptop-runnable cyber reasoning system, AIxCC second place",
  "maintainer": "Trail of Bits",
  "url": "https://github.com/trailofbits/buttercup",
  "repo": "https://github.com/trailofbits/buttercup",
  "category": "aixcc",
  "targets": [
    "C",
    "Java"
  ],
  "approach": "LLM plus fuzzing plus program analysis using non-reasoning models; finds and patches",
  "license": "Open source",
  "status": "Open-sourced 2025",
  "summary": "Buttercup placed second in AIxCC (3 million dollars), finding 28 vulnerabilities across 20 CWEs at 90 percent accuracy and about 181 dollars per point using only non-reasoning models. Trail of Bits released a version that runs on a laptop.",
  "details": [
    "Buttercup is the cheapest credible starting point for self-hosted AI bug finding on C code, and its author firm uses AI across its audit practice."
  ],
  "strengths": [
    "Cheap and self-hostable.",
    "High accuracy in the final.",
    "Maintained by an audit firm."
  ],
  "limits": [
    "C and Java.",
    "Fuzzing-dependent: needs harnesses.",
    "Not cryptography-aware."
  ],
  "fit": [
    "Run on C cryptographic libraries with existing fuzz harnesses."
  ],
  "references": [
    [
      "Buttercup repository",
      "https://github.com/trailofbits/buttercup"
    ]
  ],
  "category_name": "Cyber reasoning systems (DARPA AIxCC)",
  "page": "https://agentsast.com/tools/buttercup/",
  "updated": "2026-09-13"
}