All You Need Is A Fuzzing Brain: An LLM-Powered System for Automated
  Vulnerability Detection and Patching
Authors: name: Ze Sheng; name: Qingxiao Xu; name: Jianwei Huang; name: Matthew Woodcock; name: Heqing Huang; name: Alastair F. Donaldson; name: Guofei Gu; name: Jeff Huang
Published: 2025-09-08 21:08:01

Abstract: Our team, All You Need Is A Fuzzing Brain, was one of seven finalists in
DARPA's Artificial Intelligence Cyber Challenge (AIxCC), placing fourth in the
final round. During the competition, we developed a Cyber Reasoning System
(CRS) that autonomously discovered 28 security vulnerabilities - including six
previously unknown zero-days - in real-world open-source C and Java projects,
and successfully patched 14 of them. The complete CRS is open source at
https://github.com/o2lab/afc-crs-all-you-need-is-a-fuzzing-brain. This paper
provides a detailed technical description of our CRS, with an emphasis on its
LLM-powered components and strategies. Building on AIxCC, we further introduce
a public leaderboard for benchmarking state-of-the-art LLMs on vulnerability
detection and patching tasks, derived from the AIxCC dataset. The leaderboard
is available at https://o2lab.github.io/FuzzingBrain-Leaderboard/.