DARPA's AI Cyber Challenge (AIxCC) showed that cyber reasoning systems (CRSs) can go beyond vulnerability discovery to autonomously confirm and patch bugs: seven teams built such systems and open-sourced them after the competition. Yet all seven open-sourced CRSs remain largely unusable outside their original teams, each bound to the competition cloud infrastructure that no longer exists. We present OSS-CRS, an open, locally deployable framework for running and combining CRS techniques against real-world open-source projects, with budget-aware resource management. We ported the first-place system (Atlantis) and discovered 10 previously unknown bugs (three of high severity) across 8 OSS-Fuzz projects. OSS-CRS is publicly available.

翻译：DARPA的AI网络挑战赛（AIxCC）表明，网络推理系统（CRS）不仅能发现漏洞，还能自主确认并修补缺陷：七支团队构建了此类系统，并在赛后将其开源。然而，所有七个开源CRS在脱离原始团队后几乎无法使用——它们均绑定于现已不复存在的竞赛云基础设施。我们提出OSS-CRS，一个开放且可本地部署的框架，用于针对实际开源项目运行和组合CRS技术，并配备预算感知的资源管理方案。我们移植了冠军系统（Atlantis），并在8个OSS-Fuzz项目中发现了10个先前未知的漏洞（其中三个为高严重性）。OSS-CRS现已公开可用。