{
  "slug": "roboduck",
  "name": "RoboDuck",
  "tagline": "Theori's LLM-only proof-of-vulnerability pipeline, AIxCC third place",
  "maintainer": "Theori",
  "url": "https://theori.io",
  "category": "aixcc",
  "targets": [
    "C",
    "Java"
  ],
  "approach": "LLM-only pipeline with no fuzzing or symbolic execution",
  "license": "Open source",
  "status": "Open-sourced 2025",
  "summary": "RoboDuck placed third in AIxCC (1.5 million dollars) with a pipeline that relies on LLM reasoning alone to produce proofs of vulnerability, without fuzzing or symbolic execution.",
  "details": [
    "It is the cleanest measurement of what models alone achieve under competition rules, and the baseline the hybrid systems beat."
  ],
  "strengths": [
    "Simple architecture.",
    "Competitive result without fuzzing."
  ],
  "limits": [
    "No execution ground truth.",
    "C and Java."
  ],
  "fit": [
    "Read it to understand the ceiling of pure-LLM approaches."
  ],
  "references": [
    [
      "DARPA AIxCC results (2025-08-08)",
      "https://www.darpa.mil/news/2025/aixcc-results"
    ],
    [
      "AIxCC systems SoK (arXiv 2602.07666)",
      "https://arxiv.org/abs/2602.07666"
    ]
  ],
  "category_name": "Cyber reasoning systems (DARPA AIxCC)",
  "page": "https://agentsast.com/tools/roboduck/",
  "updated": "2026-09-13"
}