DARPA reports that seven finalist cyber reasoning systems analyzed over 54 million lines of code, found 54 unique synthetic vulnerabilities in 63 challenges and patched 43, and found 18 real non-synthetic vulnerabilities with 11 patches. Team Atlanta won $4 million, Trail of Bits $3 million and Theori $1.5 million; DARPA and ARPA-H added $1.4 million for real-world integration and four systems were open-sourced on the day.
Why it matters
It is an organizer-verified, competition-scale measurement of autonomous AI vulnerability discovery and patching, with open-sourced systems others can reuse.
Key facts
As stated in the sources, with where to find them.
- Systems found 54 unique synthetic vulnerabilities in 63 challenges and patched 43; they also found 18 real vulnerabilities (6 in C, 12 in Java) and provided 11 patches for real vulnerabilities.DARPA release, 'Deep Dive: Final Competition Findings'
- Teams identified 86% of the 63 synthetic vulnerabilities (vs 37% at semifinals) and patched 43 of 63 (68%; about 80% of those found).Deep Dive section; editor's note
- Average patch submission time about 45 minutes; average cost about $152 per competition task; over 54 million lines of code analyzed.DARPA release, highlights list
- Anthropic, Google and OpenAI each donated $350,000 in LLM credits ($50,000 per team) for the final.DARPA release, closing paragraph
- Trail of Bits reports Buttercup found 28 vulnerabilities and applied 19 patches across 48 challenges, with total spend of $39.6k ($21.1k LLM, $18.5k compute); it is open-sourced under AGPL-3.0.Trail of Bits post; buttercup README
- Team Atlanta says its Atlantis system contributed 3 of the 6 C/C++ and 3 of the 12 Java real-world bugs, and it is donating $2.0 million of its prize to SSLab at Georgia Tech.Team Atlanta post
Findings that cite this record
Key questions this bears on
- Is AI shifting the balance between finding and fixing vulnerabilities?Discovery is ahead. AI finds real vulnerabilities faster than they are fixed, and simple checks overstate how often AI patches work.
Sources
Related records
Aug 11, 2024
Feb 7, 2026
Aug 9, 2023
Mar 9, 2026
Oct 3, 2025
May 22, 2026