# OSS-CRS: Liberating AIxCC Cyber Reasoning Systems for Real-World Open-Source Security

arXiv: https://arxiv.org/abs/2603.08566 · HTML: https://mlsanity.com/paper/2603.08566/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 Mar 2026.

## Built on by (most cited first, 2 of 2)

- [Code-Augur: Agentic Vulnerability Detection via Specification Inference](https://mlsanity.com/paper/2606.18619/) (2026)
- [Chai: Agentic Discovery of Cryptographic Misuse Vulnerabilities](https://mlsanity.com/paper/2606.26933/) (2026)

## Abstract (arXiv)

DARPA's AI Cyber Challenge (AIxCC) showed that cyber reasoning systems (CRSs) can go beyond vulnerability discovery to autonomously confirm and patch bugs: seven teams built such systems and open-sourced them after the competition. Yet all seven open-sourced CRSs remain largely unusable outside their original teams, each bound to the competition cloud infrastructure that no longer exists. We present OSS-CRS, an open, locally deployable framework for running and combining CRS techniques against real-world open-source projects, with budget-aware resource management. We ported the first-place system (Atlantis) and discovered 10 previously unknown bugs (three of high severity) across 8 OSS-Fuzz projects. OSS-CRS is publicly available.