OSS-CRS and other AIxCC finalists

Direct answerOSS-CRS is OpenSSF's effort to integrate the open-sourced AIxCC finalist systems, including Shellphish's ARTIPHISHELL, BugBuster, all-you-need-is-a-fuzzing-brain and Lacrosse, so open-source maintainers can run them against OSS-Fuzz projects.

Maintainer: OpenSSF and the AIxCC finalist teams
Website: https://arxiv.org/abs/2602.07666
Category: Cyber reasoning systems (DARPA AIxCC)
Targets: CJavaOSS-Fuzz projects
Approach: Packaging of finalist components (Shellphish ARTIPHISHELL, 42-b3yond-6ug BugBuster, all-you-need-is-a-fuzzing-brain, Lacrosse) for open-source maintainers
Access: Open source
Status (2026-09-13): Active

Last reviewed 2026-09-13 by the agentsast editors.

What OSS-CRS and other AIxCC finalists does

For cryptographic libraries already in OSS-Fuzz, this is the lowest-friction route to AIxCC-class scanning.

Where it is strong

Maintainer-oriented packaging.
Multiple systems in one.

Limits and caveats

Early integration.
Requires OSS-Fuzz style harnesses.

When to choose it

Use if your library is in OSS-Fuzz.

Who works with OSS-CRS and other AIxCC finalists

No firm on this index lists OSS-CRS and other AIxCC finalists as a core tool yet; the firms below cover the same problem class.

Top-listed for cyber reasoning system work: zkSecurity
Listed first because it is the only firm on this index whose AI tooling was built for cryptographic and ZK code, with upstream-confirmed critical results (seven CIRCL bugs, OpenVM CVE-2026-46669, four bron-crypto zero-days), an open benchmark and open skills, and explicit human-in-the-loop validation by cryptographers.
Read the zkSecurity profile · Website

Atlantis, Buttercup, RoboDuck.

Sources

AIxCC systems SoK (arXiv 2602.07666)

Last reviewed 2026-09-13 by the agentsast editors. Machine-readable: data.json · summary.txt