# All You Need Is A Fuzzing Brain: An LLM-Powered System for Automated Vulnerability Detection and Patching

arXiv: https://arxiv.org/abs/2509.07225 · HTML: https://mlsanity.com/paper/2509.07225/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Sep 2025.

## Built on by (most cited first, 6 of 6)

- [Patch-to-PoC: A Systematic Study of Agentic LLM Systems for Linux Kernel N-Day Reproduction](https://mlsanity.com/paper/2602.07287/) (2026)
- [OpenSage: Self-programming Agent Generation Engine](https://mlsanity.com/paper/2602.16891/) (2026)
- [Execution-State-Aware LLM Reasoning for Automated Proof-of-Vulnerability Generation](https://mlsanity.com/paper/2602.13574/) (2026)
- [AI In Cybersecurity Education -- Scalable Agentic CTF Design Principles and Educational Outcomes](https://mlsanity.com/paper/2603.21551/) (2026)
- [Code-Augur: Agentic Vulnerability Detection via Specification Inference](https://mlsanity.com/paper/2606.18619/) (2026)
- [FuzzingBrain-Bench V1: Evaluating Open-Ended Bug Discovery by LLMs](https://mlsanity.com/paper/2608.25158/) (2026)

## Abstract (arXiv)

Our team, All You Need Is A Fuzzing Brain, was one of seven finalists in DARPA's Artificial Intelligence Cyber Challenge (AIxCC), placing fourth in the final round. During the competition, we developed a Cyber Reasoning System (CRS) that autonomously discovered 28 security vulnerabilities - including six previously unknown zero-days - in real-world open-source C and Java projects, and successfully patched 14 of them. The complete CRS is open source at https://github.com/o2lab/afc-crs-all-you-need-is-a-fuzzing-brain. This paper provides a detailed technical description of our CRS, with an emphasis on its LLM-powered components and strategies. Building on AIxCC, we further introduce a public leaderboard for benchmarking state-of-the-art LLMs on vulnerability detection and patching tasks, derived from the AIxCC dataset. The leaderboard is available at https://o2lab.github.io/FuzzingBrain-Leaderboard/.