The Problem
Traditional development workflows catch logic bugs, but memory safety vulnerabilities — buffer overflows, integer overflows, use-after-free — are invisible to code review, unit tests, and CI pipelines.
70% of security
vulnerabilities in C/C++ are memory safety bugs.
They cost $4.88M per
breach on average.
They're undetectable by code review alone.
The Technique
Fuzzing throws millions of random inputs at your code to find inputs that cause crashes. Combined with sanitizers (runtime checks), it catches buffer overflows, memory corruption, and other bugs that human reviewers miss.
Random Input
http_parse_request()
Result
Click "Run Fuzzer" to start
The fuzzer found a heap buffer overflow — a write past the end of allocated memory. An attacker could exploit this for remote code execution.
Developer Experience
Assign Delta CRS as a reviewer on your merge request. It analyzes your code, fuzzes it, finds vulnerabilities, commits the fixes, and posts a report. You just review and merge.
Assign Reviewer
Developer assigns Delta CRS
Analyze
Read diff, find vulnerabilities
Fuzz
Generate harness, run campaign
Commit Fix
Push patches to MR branch
Report
Post findings as MR comment
Architecture
Three specialized AI agents chained via GitLab Duo routers. Each step has scoped tools — analyze reads, fuzz writes and executes, report commits and posts.
analyze
10 tools · 180s timeout
Reads the MR diff, loads full source files for context, identifies vulnerability classes (buffer overflows, integer issues, input handling), plans fuzz targets.
fuzz
5 tools · 300s timeout
Generates a libFuzzer harness targeting vulnerable functions. Compiles with clang + ASan. Runs the compile-fix loop. Executes fuzzing campaign. Reproduces crashes.
report
6 tools · 120s timeout
Reads vulnerable files, generates fixes, commits patches directly to the MR branch via create_commit. Posts structured report with severity badges, stack traces, and patch diffs.
Key Innovation
LLMs hallucinate struct members and invent function signatures. Instead of hoping for perfect code, we compile immediately and feed errors back to Claude until it gets it right.
Claude generates harness
LLVMFuzzerTestOneInput() targeting http_parse_request...
clang: 2 errors
error: cannot initialize 'char *' with rvalue of type 'void *'
error: no member named 'uri' in 'http_request_t'
Claude fixes errors
Added (char*) cast, changed req.uri to req.path...
Compilation successful
Built fuzz_target with -fsanitize=address,fuzzer
CRITICAL: heap-buffer-overflow
Found in 5 seconds · 754,071 executions · CWE-122
Powered by Anthropic
Each task uses a different Claude interaction pattern — structured JSON, code generation, or multi-turn tool use — with purpose-built system prompts.
Diff Analysis
generate_json
Identifies security-relevant changes, classifies risk, suggests fuzz targets
Harness Generation
generate_code
Writes complete libFuzzer harnesses targeting vulnerable functions
Harness Evaluation
generate_json
Scores existing harnesses 1-10, identifies coverage gaps
Corpus Synthesis
generate_code
Generates Python seed scripts producing protocol-aware inputs
Dictionary Generation
generate_json x3
Three parallel strategies: operand extraction, bug triggers, format strings
Patch Generation
generate_with_tools
Multi-turn ReAct agent with view_file, search_symbol tools for fault localization
Real Output
A structured security report posted as an MR comment, plus auto-committed patches.
Delta CRS
posted 2 minutes ago
| Metric | Value |
|---|---|
| Duration | 1.3 min |
| Total crashes | 1 |
| Severity | 1 CRITICAL |
CRITICAL — heap-buffer-overflow (WRITE)
Location: http_parse_request at minihttp.c:201
CWE: CWE-122
In MR diff: Yes
--- a/minihttp.c
+++ b/minihttp.c
- memcpy(req->body, body_start, content_length);
+ if (content_length > MAX_BODY_SIZE) return -1;
+ memcpy(req->body, body_start, content_length);
Demo Target
Our demo uses minihttp — a minimal HTTP/1.1 parser with 4 intentional security bugs. Delta CRS
finds and patches them automatically.
Header Buffer Overflow
http_parse_headers()
Unbounded memcpy into 256-byte buffer from attacker-controlled header value
Integer Overflow
http_parse_headers()
atoi() on Content-Length wraps negative, causing undersized malloc then heap overflow
Chunked Overflow
http_decode_chunked()
Per-chunk size check but no cumulative length check — total exceeds output buffer
URL Decode Off-by-One
http_url_decode()
Null terminator written one byte past destination buffer end
Built with Claude on the GitLab Duo Agent Platform.
Adapted from DARPA AIxCC 1st place winner.