DARPA's AI Cyber Challenge (AIxCC) showed that cyber reasoning systems (CRSs) can go beyond vulnerability discovery to autonomously confirm and patch bugs: seven teams built such systems and open-sourced them after the competition. Yet all seven open-sourced CRSs remain largely unusable outside their original teams, each bound to the competition cloud infrastructure that no longer exists. We present OSS-CRS, an open, locally deployable framework for running and combining CRS techniques against real-world open-source projects, with budget-aware resource management. We ported the first-place system (Atlantis) and discovered 10 previously unknown bugs (three of high severity) across 8 OSS-Fuzz projects. OSS-CRS is publicly available.
Cite
@article{arxiv.2603.08566,
title = {OSS-CRS: Liberating AIxCC Cyber Reasoning Systems for Real-World Open-Source Security},
author = {Andrew Chin and Dongkwan Kim and Yu-Fu Fu and Fabian Fleischer and Youngjoon Kim and HyungSeok Han and Cen Zhang and Brian Junekyu Lee and Hanqing Zhao and Taesoo Kim},
journal= {arXiv preprint arXiv:2603.08566},
year = {2026}
}
Comments
Version 1.1 (March 2026), OSS-CRS: an open-source framework for porting, deploying, and composing AIxCC cyber reasoning systems. Project page: https://github.com/ossf/oss-crs