Andrew Chin, Georgia Institute of Technology; Dongkwan Kim, Microsoft; Yu-Fu Fu, Fabian Fleischer, and Youngjoon Kim, Georgia Institute of Technology; HyungSeok Han and Cen Zhang, Microsoft; Brian Junekyu Lee and Hanqing Zhao, Georgia Institute of Technology; Taesoo Kim, Georgia Institute of Technology and Microsoft
DARPA's AI Cyber Challenge (AIxCC) showed that cyber reasoning systems (CRSs) can go beyond vulnerability discovery to autonomously confirm and patch bugs: seven teams built such systems and open-sourced them after the competition. Yet the majority of open-sourced CRSs remain largely unusable outside their original teams, each bound to the competition cloud infrastructure that no longer exists. We present OSS-CRS, an open, locally deployable framework for running and combining CRS techniques against real-world open-source projects, with budget-aware resource management. We ported components from every AIxCC finalist CRS. Using the first-place system (Atlantis), we discovered 7 previously unknown bugs (one of high severity) across 6 OSS-Fuzz projects. OSS-CRS is publicly available as a sandbox project in the OpenSSF.
