TLDR: Trail of Bits’ Buttercup, an open-source, AI-driven system designed to automatically detect and patch software vulnerabilities, has achieved significant recognition by securing second place and a $3 million prize in DARPA’s Artificial Intelligence Cyber Challenge (AIxCC). Unveiled at DEF CON 33, Buttercup demonstrated remarkable efficiency and accuracy in identifying and remediating flaws in open-source software, leveraging a multi-agent AI architecture and advanced fuzzing techniques.
Las Vegas, NV – August 18, 2025 – A groundbreaking stride in cybersecurity has been announced with Trail of Bits’ Buttercup, an innovative open-source, AI-driven system, clinching second place in the prestigious DARPA Artificial Intelligence Cyber Challenge (AIxCC). The announcement, made on August 8, 2025, at DEF CON 33 in Las Vegas, highlights Buttercup’s capability to autonomously discover and patch software vulnerabilities, marking a significant advancement in securing open-source ecosystems.
Buttercup, a sophisticated Cyber Reasoning System (CRS), is engineered to streamline the laborious process of identifying and remediating software flaws. Its core functionality relies on a fully automated, AI-driven approach, integrating several key components: an Orchestration/UI for workflow management, an AI-augmented mutational fuzzing engine for vulnerability discovery, a contextual analysis system utilizing traditional static analysis tools, and a multi-agentic patch generation system. This patch generation system notably employs seven distinct AI agents to create and validate robust software patches, ensuring fixes without compromising other program functionalities.
The AIxCC, a rigorous two-year competition, challenged participants to develop fully automated systems capable of securing open-source software without human intervention. In the final round, Buttercup faced 48 challenges across 23 open-source repositories. Trail of Bits’ system successfully identified 28 vulnerabilities and applied 19 patches, demonstrating a 90% accuracy rate in finding vulnerabilities across 20 Common Weakness Enumerations (CWEs) from Mitre’s Top 25 Most Dangerous CWEs.
Trail of Bits’ performance was not only about accuracy but also efficiency. The team’s ‘Buttercup’ system achieved a remarkable cost-per-point efficiency of $181, spending a total of $39.6k on LLM and compute resources, significantly less than the top-ranked Team Atlanta’s $263 per point. This underscores Buttercup’s potential for widespread adoption within the open-source community, where cost-effectiveness is paramount.
Among its notable achievements in the AIxCC, Buttercup earned special recognition as ‘LOC Ness Monster’ for submitting the largest software patch in the competition, exceeding 300 lines of code. It also received ‘Cornucopia’ for successfully exploiting 20 unique CWEs. Furthermore, the system demonstrated its prowess by scoring less than five minutes into a task, making over 100,000 LLM requests, and even finding a Proof of Vulnerability (PoV) that triggered a flaw not intentionally inserted into the challenge. Impressively, Trail of Bits achieved these results primarily using less expensive, non-reasoning Large Language Models (LLMs).
Following the competition, DARPA and ARPA-H have offered an additional $200,000 to each AIxCC team to facilitate the integration of their CRSs into critical software infrastructure. Trail of Bits is actively exploring further optimizations for Buttercup, aiming to enhance its capabilities and broaden its applicability across various C and Java source code repositories.
Also Read:
- AI Red Teaming: Uncovering Vulnerabilities and Top Tools for 2025
- Chinese AI Innovator DeepSeek Grapples with Extensive Cyber Attack Fallout
Buttercup is now available as an open-source tool, designed to be accessible and runnable on a typical laptop, requiring a minimum of 8 CPU cores, 16 GB of RAM, 100 GB of disk space, and an API key for a third-party LLM provider. This open-sourcing initiative is set to empower the security community, fostering collaborative efforts in the continuous battle against software vulnerabilities.
