OSS-CRS: Next Generation Bug-Finding and Remediation for the LLM Era - Andrew Chin

Why It Matters

OSS‑CRS democratizes autonomous vulnerability remediation, enabling faster, scalable patching of open‑source software and easing the triage burden on maintainers.

Key Takeaways

• AI Cyber Challenge highlighted need for autonomous patching pipelines
• OSS‑CRS modularizes bug‑finding and fixing for open‑source projects
• Framework supports local, cloud, and custom LLM endpoints
• Delta‑scan mode enables targeted analysis of PR diffs
• Resource management caps compute and LLM budget per run

Summary

The presentation introduced OSS‑CRS, an open‑source framework that extracts and modularizes the bug‑finding and patching techniques developed during DARPA’s AI Cyber Challenge. The competition required cyber‑reasoning systems (CRSs) to locate vulnerabilities, generate proof‑of‑vulnerability inputs, and automatically produce patches, with a scoring system that favored end‑to‑end remediation. While several teams released their CRSs, most remain unmaintained, suffer from cloud‑lock‑in, monolithic designs, and duplicated infrastructure, limiting broader adoption.

Key insights include the asymmetry in today’s vulnerability lifecycle: automated tools flood maintainers with reports, yet triage and patching remain bottlenecks. OSS‑CRS addresses this by centralizing infrastructure, providing resource‑management hooks, and exposing helper libraries (libCRS) that abstract Docker orchestration, artifact transfer, and LLM budgeting. The framework aligns with OSS‑Fuzz’s ecosystem, supporting over a thousand projects, and introduces flexible deployment configurations—local laptops, Kubernetes, or custom LLM proxies—so users can run multiple CRSs in parallel without Azure dependencies.

The speaker highlighted concrete components: a three‑stage pipeline (prepare, build target, run), delta‑scan mode for diff‑driven analysis, and a composable YAML/compose file that defines compute limits, model aliases, and API keys. Demonstrations showed how a CRS can be registered, built, and executed against a fuzz harness, producing proof‑of‑vulnerability inputs and patches. The modular design also enables security researchers to contribute new CRSs via a simple registry PR, while security engineers can tailor resource caps to corporate policies.

Implications are significant: by lowering the engineering barrier, OSS‑CRS can accelerate autonomous remediation across the open‑source supply chain, reduce the triage backlog, and democratize access to advanced AI‑driven security tooling. The framework’s extensibility promises faster iteration on bug‑finding techniques and broader community participation, potentially reshaping how vulnerabilities are addressed in the LLM era.

Original Description

Keynote: OSS-CRS: Next Generation Bug-Finding and Remediation for the LLM Era - Andrew Chin, Georgia Institute of Technology

The AI Cyber Challenge demonstrated that AI-powered Cyber Reasoning Systems (CRS) can autonomously find and fix software vulnerabilities at scale. But how do we take those advancements and make them accessible to the broader security community? Enter OSS-CRS: an open-source, standardized framework designed to accelerate the development of AI-assisted bug-finding and remediation systems. In this session, we'll walk through the design principles of OSS-CRS, show how it lowers the barriers to building and benchmarking next-generation CRS tooling, and demonstrate how users can easily deploy and run CRSs against their own codebases. Whether you're a security researcher, tooling developer, AI practitioner, or project maintainer, come learn about the growing ecosystem around AI-powered CRSs.