DARPA's AI Cyber Challenge (AIxCC) showed that cyber reasoning systems (CRSs) can go beyond vulnerability discovery to autonomously confirm and patch bugs: seven teams built such systems and open-sourced them after the competition. Yet all seven open-sourced CRSs remain largely unusable outside their original teams, each bound to the competition cloud infrastructure that no longer exists. We present OSS-CRS, an open, locally deployable framework for running and combining CRS techniques against real-world open-source projects, with budget-aware resource management. We ported the first-place system (Atlantis) and discovered 10 previously unknown bugs (three of high severity) across 8 OSS-Fuzz projects. OSS-CRS is publicly available.

翻译：DARPA的AI网络挑战赛（AIxCC）表明，网络推理系统（CRSs）能够超越漏洞发现，实现自主确认并修复错误：七支参赛队伍构建了此类系统并在赛后将其开源。然而，这七个开源CRS在其原始团队之外基本无法使用，每个系统均受限于已不复存在的竞赛云基础设施。本文提出OSS-CRS，这是一个开放的、可本地部署的框架，用于在现实世界开源项目中运行和组合CRS技术，并具备预算感知的资源管理功能。我们移植了冠军系统（Atlantis），并在8个OSS-Fuzz项目中发现了10个先前未知的漏洞（其中三个为高危漏洞）。OSS-CRS已公开可用。