OpenSSF

OSS-CRS: Next Generation Bug-Finding and Remediation for the LLM Era - Andrew Chin

The presentation introduced OSS‑CRS, an open‑source framework that extracts and modularizes the bug‑finding and patching techniques developed during DARPA’s AI Cyber Challenge. The competition required cyber‑reasoning systems (CRSs) to locate vulnerabilities, generate proof‑of‑vulnerability inputs, and automatically produce patches, with a scoring system that favored end‑to‑end remediation. While several teams released their CRSs, most remain unmaintained, suffer from cloud‑lock‑in, monolithic designs, and duplicated infrastructure, limiting broader adoption. Key insights include the asymmetry in today’s vulnerability lifecycle: automated tools flood maintainers with reports, yet triage and patching remain bottlenecks. OSS‑CRS addresses this by centralizing infrastructure, providing resource‑management hooks, and exposing helper libraries (libCRS) that abstract Docker orchestration, artifact transfer, and LLM budgeting. The framework aligns with OSS‑Fuzz’s ecosystem, supporting over a thousand projects, and introduces flexible deployment configurations—local laptops, Kubernetes, or custom LLM proxies—so users can run multiple CRSs in parallel without Azure dependencies. The speaker highlighted concrete components: a three‑stage pipeline (prepare, build target, run), delta‑scan mode for diff‑driven analysis, and a composable YAML/compose file that defines compute limits, model aliases, and API keys. Demonstrations showed how a CRS can be registered, built, and executed against a fuzz harness, producing proof‑of‑vulnerability inputs and patches. The modular design also enables security researchers to contribute new CRSs via a simple registry PR, while security engineers can tailor resource caps to corporate policies. Implications are significant: by lowering the engineering barrier, OSS‑CRS can accelerate autonomous remediation across the open‑source supply chain, reduce the triage backlog, and democratize access to advanced AI‑driven security tooling. The framework’s extensibility promises faster iteration on bug‑finding techniques and broader community participation, potentially reshaping how vulnerabilities are addressed in the LLM era.