BigEye

Inspiration

I designed the first version of BigEye around two years ago. I had already been working with fuzzing for much longer. The idea came from repeatedly seeing the same gap: fuzzing engines can execute inputs for hours, but a useful campaign still needs a fuzz tester to choose targets, repair harnesses, improve corpora, investigate weak coverage, change strategy and triage crashes.

I wanted to build the specialised fuzz tester around AFL++ and libFuzzer, rather than another fuzzing engine.

What it does

BigEye turns a software project into a continuously managed, inspectable fuzzing campaign. The user provides the project's source code through a Git repository and selects the exact revision to test.

It can:

• prepare reusable linux/amd64 build layers;
• select component-level libFuzzer targets and whole-system AFL++ targets;
• generate and incrementally repair harnesses, build configuration, patches and initial corpora;
• validate proposed targets through real builds and deterministic probes;
• monitor clean line, function and branch coverage;
• react when coverage stalls or a campaign becomes unhealthy;
• minimise corpora and reduce redundant work;
• replay, minimise, group, classify and prioritise crash candidates;
• expose campaign decisions, tool activity, logs, coverage and findings in a local interface.

The fuzzer processes are not agents. Once a campaign is healthy, it runs continuously in Docker without spending model tokens.

How I built it

I started by taking what I knew from fuzz testing and writing down the complete product intention. In a separate Codex chat, I used that document for a long brainstorming session and asked Codex to challenge my assumptions with up to 200 explicit questions about the scope, user journey, agent responsibilities, fuzzing infrastructure, technology choices and code organisation. I refined the answers into the software requirements that guided the implementation.

The first development pass ran continuously for 18 hours with GPT-5.6 Sol at Extra High reasoning effort. I used Codex as the development environment and GPT-5.6 for implementation, debugging and review.

GPT-5.6 and Codex during development

I used Jesse Vincent's Superpowers plugin for Codex. Three skills were especially important:

• Writing Plans turned approved decisions into explicit, file-specific implementation tasks.
• Test-Driven Development made each behaviour start with a test that demonstrated what was missing, followed by the smallest implementation and a confirming test run.
• Subagent-Driven Development split focused implementation and review work between separate agents, allowing independent modules to progress faster without giving every agent the whole project at once.

This workflow was central to finishing a reliable MVP within the available weekend.

GPT-5.6 inside BigEye

GPT-5.6 is also part of the product itself:

• GPT-5.6 Terra is the campaign manager. It keeps the project objective in view and decides which bounded work is useful next.
• GPT-5.6 Luna handles the normal specialist-worker attempt. Difficult work can be escalated to Terra.
• The OpenAI Agents SDK provides typed agents, structured outputs, tracing and Agent.as_tool() as the delegation boundary.
• Independent target preparation or investigation tasks can run in parallel, while changes to the same generated asset remain serial and incremental.

Agents interpret source code and make technical decisions. Deterministic BigEye services still perform repository cloning, Docker builds, target probes, scheduling, fuzzing, coverage measurement, corpus admission, crash replay and grouping. A model proposal is never treated as proof that a target or finding is valid.

BigEye is a local, single-user application. FastAPI and React run on the host. PostgreSQL, builds, fuzzers, replay and coverage jobs run through Docker, with every container forced to linux/amd64. The image strategy uses reusable toolchain, repository, dependency, project, target and clean-coverage layers. BigEye does not use OSS-Fuzz or OSS-Fuzz-Gen images or source code.

Challenges I ran into

The main challenge was time. I work full-time, so I could only commit properly to the project during the weekend. That left very little time to run long fuzzing campaigns, test BigEye against a wider range of real projects and improve every part of the product as much as I wanted before submission.

Accomplishments I am proud of

The MVP works, and I am proud of that. BigEye can take a software project, prepare targets, run campaigns, collect coverage and present its activity through one interface.

I am also proud that I finally found the time and commitment to build a project I had been thinking about for around two years. Turning it from an idea into a working product within one intense weekend means a lot to me.

What I learned

I learned how to use Codex much more effectively. I use Codex every day, so I could clearly feel the difference between GPT-5.6 and previous versions. GPT-5.6 was extremely powerful throughout implementation, debugging and review.

I also learned how to use the Superpowers skills, and they changed the way I approached the build. Test-Driven Development helped me produce reliable code without manually repeating every verification step, while Subagent-Driven Development made it possible to progress much faster across independent parts of the application. Writing Plans kept that speed tied to an explicit design instead of letting the implementation drift.

What's next

My priority is to keep BigEye stable, run it against more projects, identify the gaps exposed by longer real campaigns and improve it step by step.

I do not know where it will lead yet. If the project proves useful and continues to mature, perhaps it could be commercialised in the future.

Personal note

BigEye began as a project I designed some time ago but never found the right moment to implement. I would like to thank a very close friend for giving me the excuse to finally work on it.

If BigEye wins, I would like to allocate all of the prize funds to support her studies, as she is struggling to pursue her dream career. Helping her continue that journey would mean more to me than any personal prize.

Built With

• afl++
• docker
• fastapi
• gpt-5.6
• libfuzzer
• llvm
• openai-agents-sdk
• postgresql
• python
• react
• typescript