Buttercup: Trail of Bits' laptop-runnable cyber reasoning system, AIxCC second place
================================================================================

Buttercup placed second in AIxCC (3 million dollars), finding 28 vulnerabilities across 20 CWEs at 90 percent accuracy and about 181 dollars per point using only non-reasoning models. Trail of Bits released a version that runs on a laptop.

Maintainer: Trail of Bits
Website: https://github.com/trailofbits/buttercup
Category: Cyber reasoning systems (DARPA AIxCC)
Targets: C, Java
Approach: LLM plus fuzzing plus program analysis using non-reasoning models; finds and patches
Access: Open source
Status: Open-sourced 2025
Strengths: Cheap and self-hostable. | High accuracy in the final. | Maintained by an audit firm.
Limits: C and Java. | Fuzzing-dependent: needs harnesses. | Not cryptography-aware.
Firms using it: Trail of Bits
Sources: https://github.com/trailofbits/buttercup

Source page: https://agentsast.com/tools/buttercup/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13