Buttercup is now open-source!
Summary: Trail of Bits placed second in DARPA's AI Cyber Challenge and has released its cyber reasoning system, Buttercup, as open source, including a standalone version that runs on a typical laptop and the versions entered in the semifinal and final rounds. Buttercup is a fully automated, AI-driven system that combines AI-augmented mutational fuzzing built on OSS-Fuzz, Clusterfuzz, libFuzzer and Jazzer, static analysis with tree-sitter and CodeQuery, and a seven-agent patch generation system that iteratively creates and tests patches until they block the proof of vulnerability and preserve other program functions.
What's compelling: Trail of Bits took the runner-up prize of $3M at the AIxCC, and the standalone Buttercup needs only 8 CPU cores, 16 GB of RAM, 100 GB of disk and an LLM API key - meaning automated vulnerability discovery and patching is now something an individual can run on a laptop against their own code.
Read the original at Trail of Bits Blog ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026