In the final episode of our AI Cyber Challenge (AIxCC) series, CRob sits down with Michael Brown, Principal Security Engineer at Trail of Bits, to discuss their runner-up cybersecurity reasoning system, Buttercup. Michael shares how their team took a hybrid approach - combining large language models with conventional software analysis tools like fuzzers - to create a system that exceeded even their own expectations. Learn how Trail of Bits made Buttercup fully open source and accessible to run on a laptop, their commitment to ongoing maintenance with prize winnings, and why they believe AI works best when applied to small, focused problems rather than trying to solve everything at once.This episode is part 3 of a four-part series on AIxCC:AIxCC part 1: From Skepticism to Success: The AI Cyber Challenge (AIxCC) with Andrew CarneyAIxCC part 2: From Skeptics to Believers: How Team Atlanta Won AIxCC by Combining Traditional Security with LLMsAIxCC part 4: Cyber Reasoning Systems: The Real-World Journey After AIxCCChapters:00:04 - Introduction & Welcome00:12 - About Trail of Bits & Open Source Commitment03:16 - Buttercup: Second Place in AIxCC04:20 - The Hybrid Approach Strategy06:45 - From Skeptic to Believer09:28 - Surprises & Vindication During Competition11:36 - Multi-Agent Patching Success14:46 - Post-Competition Plans15:26 - Making Buttercup Run on a Laptop18:22 - The Giant Check & DEF CON18:59 - How to Access Buttercup on GitHub21:37 - Enterprise Deployment & Community Support22:23 - Closing RemarksEpisode links:Michael Brown’s LinkedIn pageAI Cyber Challenge (AIxCC)Trail of BitsButtercup GitHub RepoOpenSSF AI/ML Security Working GroupCyber Reasoning Systems Special Interest Group (Slack)Get involved with the OpenSSFSubscribe to the OpenSSF newsletterFollow the OpenSSF on LinkedIn

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Transcript

Related