OSS-Fuzz

Researchers led by Georgia Tech released OSS-CRS, a locally deployable framework for running and combining AIxCC cyber reasoning systems, noting that all seven open-sourced finalist systems depended on competition cloud infrastructure that no longer exists. Porting the winning Atlantis system, they found 10 previously unknown bugs (three high severity) in 8 OSS-Fuzz projects; OpenSSF welcomed OSS-CRS into its AI/ML Security Working Group in April 2026.

Google reports that AI-generated and AI-enhanced fuzz targets in OSS-Fuzz found 26 new vulnerabilities in projects that already had extensive fuzzing, including CVE-2024-9143 in OpenSSL. The LLM workflow drafts targets, fixes compilation errors, fixes runtime issues and triages crashes, and gained coverage in 272 C/C++ projects.

ARVO (Atlas of Reproducible Vulnerabilities for Open Source Software) builds reproducible vulnerability cases from OSS-Fuzz, each with a triggering input, a rebuildable environment and an automatically located fixing patch. The August 2024 first version reported over 5,000 memory vulnerabilities across 250+ C/C++ projects; the authors' June 2026 revision reports over 6,100 vulnerabilities across 311 projects, 81% reproduction success and 89.4% accuracy on located patches. The paper is accepted at IEEE EuroS&P 2026.

Google's open source security team reports an experiment connecting OSS-Fuzz to an LLM that writes new fuzz targets for under-fuzzed code and revises them when they fail to compile. Google reports coverage gains of 1.5% to 31% across sample projects, and that an LLM-generated target rediscovered an already-known OpenSSL vulnerability in code that previously lacked fuzzing coverage.