{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/darpa-aixcc-semifinal-results-2024/",
 "asOf": "2026-09-26",
 "id": "darpa-aixcc-semifinal-results-2024",
 "date": "2024-08-11",
 "datePrecision": "day",
 "title": "AIxCC semifinal: AI systems find 22 synthetic vulnerabilities, patch 15, and find one real SQLite bug",
 "lane": "defense",
 "kind": "competition",
 "summary": "DARPA reports that in the AIxCC semifinal at DEF CON 32, nearly 40 cyber reasoning systems were tested on challenge projects based on Jenkins, the Linux kernel, Nginx, SQLite3 and Apache Tika. Competitors' systems found 22 unique synthetic vulnerabilities, patched 15, and found one real-world SQLite3 bug; seven teams advanced with $2 million each and must open-source their systems after the final.",
 "whyItMatters": "It gave organizer-verified numbers on how well AI cyber reasoning systems could find and patch vulnerabilities in challenge projects built on widely used open-source software.",
 "actors": [
  "darpa",
  "arpa-h",
  "team-atlanta",
  "trail-of-bits",
  "theori",
  "shellphish",
  "team-42-b3yond-6ug",
  "team-fuzzing-brain",
  "team-lacrosse"
 ],
 "topics": [
  "vulnerability-discovery",
  "vulnerability-repair",
  "autonomous-defense"
 ],
 "atlas": [
  "eval-environment"
 ],
 "artifacts": [
  "aixcc"
 ],
 "sources": [
  {
   "url": "https://www.darpa.mil/news/2024/ai-cyber-challenge-cybersecurity",
   "publisher": "DARPA",
   "title": "DARPA AI Cyber Challenge Proves Promise of AI-Driven Cybersecurity",
   "date": "2024-08-11",
   "type": "primary",
   "accessed": "2026-09-25"
  },
  {
   "url": "https://www.darpa.mil/news/2024/ai-cyber-challenge-semifinal",
   "publisher": "DARPA",
   "title": "DARPA to Bring AI Cyber Challenge Semifinal Competition to DEF CON 32",
   "date": "2024-07-17",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "Competitors' systems discovered 22 unique synthetic vulnerabilities and patched 15 of those (11 unique patches for C challenges, 4 for Java).",
   "locator": "DARPA release, results paragraph"
  },
  {
   "fact": "Systems also found one real-world bug in SQLite3, disclosed under SQLite's guidelines.",
   "locator": "Same paragraph"
  },
  {
   "fact": "AIxCC received nearly 40 cyber reasoning system submissions; the seven top-scoring teams were to be awarded $2 million each and advance to the final.",
   "locator": "DARPA releases of 2024-07-17 and 2024-08-11"
  },
  {
   "fact": "Finalists must release their CRSs under an OSI-approved open-source license after the Final Competition.",
   "locator": "DARPA release, closing paragraph"
  }
 ],
 "significance": 4,
 "fideQuestions": [
  "FID-076",
  "FID-088"
 ],
 "methods": [
  "ai-vulnerability-discovery",
  "automated-patching"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}