An autonomous system that discovered 28 security vulnerabilities including 6 zero-days, and patched 14 of them, placing 4th in DARPA's AI Cyber Challenge
Our system automatically generates Proofs-of-Vulnerability (POVs) and produces patches for discovered security issues without human intervention.
Leverages 23 distinct LLM-based strategies across multiple frontier models from Anthropic, Google, and OpenAI for comprehensive analysis.
Deployed across ~100 VMs with thousands of concurrent threads, enabling rapid vulnerability discovery and patch generation.
FuzzingBrain consists of four core services working in parallel:
10 LLM-based strategies for vulnerability discovery, from basic iterative refinement to advanced multi-input generation with coverage feedback.
13 patching strategies including our novel XPatch approach that generates patches even without POVs.
Multi-turn dialogue with structured feedback loops incorporating execution results and coverage data
Resilient architecture with automatic model switching when individual LLMs fail or reach limits
Call paths, reachability, and real-time coverage feedback to guide vulnerability discovery
Most vulnerabilities detected within the first 30 minutes of analysis
LLM-based strategies discovered nearly all POVs, vastly outperforming traditional fuzzing
Successfully processed 50+ fuzzers per project across multiple sanitizer configurations
Texas A&M University
Texas A&M University
Texas A&M University
Texas A&M University
City University of Hong Kong
Imperial College London
Texas A&M University
Team Lead
Texas A&M University
Complete Cyber Reasoning System implementation with all 23 LLM-based strategies
View on GitHub →Benchmark comparing state-of-the-art LLMs on vulnerability detection and patching tasks
View Leaderboard →Detailed technical description of our CRS with emphasis on LLM-powered components
Read Paper →