trailofbits/buttercup

Health v2 · maintenance only

Adoption not part of the score

1683 stars · 183 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Buttercup is a Cyber Reasoning System (CRS) developed by Trail of Bits for the DARPA AI Cyber Challenge that automatically finds and patches software vulnerabilities in open-source C and Java repositories. It combines AI/ML-assisted fuzzing built on OSS-Fuzz with a multi-agent LLM-driven patcher to discover, analyze, and repair security bugs.

Use cases

• automatically find vulnerabilities in open-source C or Java projects
• generate patches for discovered security bugs using LLM agents
• run AI-assisted fuzzing campaigns on OSS-Fuzz compatible codebases
• participate in or replicate DARPA AI Cyber Challenge style autonomous vulnerability discovery
• audit code repositories for exploitable memory or logic bugs

When to choose

• you need autonomous end-to-end vulnerability discovery and patching for OSS-Fuzz compatible C or Java projects
• you have Linux x86_64 hardware and budget for third-party LLM API costs
• you want to experiment with multi-agent AI-driven security repair pipelines

When to avoid

• you need a lightweight scanner without heavy LLM API costs or Docker infrastructure
• your target project is not OSS-Fuzz compatible or lacks fuzzing harnesses
• you require Windows or full ARM64 support

Facets

application · maturity active

security vulnerability-scanning machine-learning llm-inference agent-framework testing security developer-tools artificial-intelligence python cyber-reasoning-system fuzzing automated-patching vulnerability-discovery aixcc oss-fuzz llm-agents automation linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="trailofbits/buttercup")