afc-crs-all-you-need-is-a-fuzzing-brain

afc-crs-all-you-need-is-a-fuzzing-brain

LLM-powered system that discovered 62 zero-day vulnerabilities across 26 open source projects. 4th place, DARPA AIxCC.

Stars: 83

Visit
 screenshot

All You Need Is A Fuzzing Brain is an AI-driven automated vulnerability detection and remediation framework developed for the 2025 DARPA AIxCC finals. It leverages multiple LLM providers for intelligent vulnerability detection, offers 23+ specialized strategies for POV generation and patch synthesis, generates and validates patches automatically, integrates seamlessly with Google's fuzzing infrastructure, and supports vulnerability detection in C/C++ and Java. Users can perform tasks such as Delta Scan, Full Scan, and SARIF Analysis for specific commits, repository-wide analysis, and validation/patching from static analysis reports, respectively. The tool can be used via Docker or by installing from source, and citations are provided for research purposes.

README:

FuzzingBrain

All You Need Is A Fuzzing Brain

Autonomous Cyber Reasoning System for Vulnerability Discovery

Python Go Docker License

Linux macOS Windows

| Documentation | Blog | Paper |


About

FuzzingBrain is an AI-driven automated vulnerability detection and remediation framework built upon the OSS-Fuzz infrastructure. Developed by the team "all_you_need_is_a_fuzzing_brain" for the 2025 DARPA AIxCC (Artificial Intelligence Cyber Challenge) finals.

Key Features

  • LLM-Powered Analysis: Leverages multiple LLM providers (OpenAI, Anthropic, Google, xAI) for intelligent vulnerability detection
  • Multi-Strategy Framework: 23+ specialized strategies for POV generation and patch synthesis
  • Automated Patch Generation: Generates and validates patches automatically
  • OSS-Fuzz Integration: Seamless integration with Google's fuzzing infrastructure
  • Multi-Language Support: C/C++ and Java vulnerability detection

Supported Task Types

  • Delta Scan: Analyze specific commits for introduced vulnerabilities
  • Full Scan: Comprehensive repository-wide vulnerability analysis
  • SARIF Analysis: Validate and patch vulnerabilities from static analysis reports

Getting Started

Option A: Using Docker (Recommended)

The easiest way to get started is using our pre-built Docker image:

# Pull the image
docker pull ghcr.io/o2lab/fuzzingbrain:latest

# Run FuzzingBrain
docker run -it --rm \
  -e OPENAI_API_KEY=your-key-here \
  -e ANTHROPIC_API_KEY=your-key-here \
  -v $(pwd)/output:/app/output \
  ghcr.io/o2lab/fuzzingbrain:latest \
  <repo_url>

Docker Run Options:

  • -e: Set API keys as environment variables (at least one required)
  • -v: Mount a local directory to save scan results
  • Add -b <base_commit> -d <delta_commit> for delta scans

Option B: Install from Source

1. Clone Repository

git clone https://github.com/aixcc-sc/afc-crs-all-you-need-is-a-fuzzing-brain.git
cd afc-crs-all-you-need-is-a-fuzzing-brain

2. Configure API Keys

cd crs && cp .env.example .env

Edit crs/.env and add your API keys (at least one required):

OPENAI_API_KEY=sk-proj-your-key-here
ANTHROPIC_API_KEY=sk-ant-your-key-here
GEMINI_API_KEY=your-key-here
XAI_API_KEY=xai-your-key-here

3. Run a Scan

# Delta Scan - analyze changes between commits
./FuzzingBrain.sh -b <base_commit> -d <delta_commit> <repo_url>

# Full Scan - analyze entire repository
./FuzzingBrain.sh <repo_url>

Visit our documentation to learn more:


Citation

If you use FuzzingBrain for your research, please cite our papers:

@misc{sheng2025needfuzzingbrainllmpowered,
  title={All You Need Is A Fuzzing Brain: An LLM-Powered System for Automated Vulnerability Detection and Patching},
  author={Ze Sheng and Qingxiao Xu and Jianwei Huang and Matthew Woodcock and Heqing Huang and Alastair F. Donaldson and Guofei Gu and Jeff Huang},
  year={2025},
  eprint={2509.07225},
  archivePrefix={arXiv},
  primaryClass={cs.CR},
  url={https://arxiv.org/abs/2509.07225},
}

@article{10.1145/3769082,
  author = {Sheng, Ze and Chen, Zhicheng and Gu, Shuning and Huang, Heqing and Gu, Guofei and Huang, Jeff},
  title = {LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insights},
  year = {2025},
  publisher = {Association for Computing Machinery},
  volume = {58},
  number = {5},
  url = {https://doi.org/10.1145/3769082},
  doi = {10.1145/3769082},
  journal = {ACM Comput. Surv.},
}

Built with determination and caffeine ☕

For Tasks:

Click tags to check more tools for each tasks

For Jobs:

Alternative AI tools for afc-crs-all-you-need-is-a-fuzzing-brain

Similar Open Source Tools

For similar tasks

For similar jobs