All You Need Is a Fuzzing Brain
An autonomous system that pairs coverage-guided fuzzing with LLM agents to find, verify and patch vulnerabilities in open-source projects, built on the OSS-Fuzz toolchain.
FuzzingBrain combines OSS-Fuzz-based coverage-guided fuzzing with a reasoning layer of specialized agents that partition a target codebase, reason about where a bug is likely to live, build a proof of vulnerability and propose a patch; every finding is dynamically verified against the running target so a claimed bug is confirmed rather than hallucinated.
It ships runnable examples covering a full scan from a GitHub URL, a delta scan of only what changed between two commits, driving a run from a JSON task file, and exposing the system as a REST API or an MCP server. It requires Docker, an API key for Anthropic, OpenAI or Google Gemini, and substantial disk space, since an OSS-Fuzz build tree can run to several gigabytes per target.
The project placed fourth in DARPA's AIxCC competition and is written in Python.