DARPA reports that in the AIxCC semifinal at DEF CON 32, nearly 40 cyber reasoning systems were tested on challenge projects based on Jenkins, the Linux kernel, Nginx, SQLite3 and Apache Tika. Competitors' systems found 22 unique synthetic vulnerabilities, patched 15, and found one real-world SQLite3 bug; seven teams advanced with $2 million each and must open-source their systems after the final.
Why it matters
It gave organizer-verified numbers on how well AI cyber reasoning systems could find and patch vulnerabilities in challenge projects built on widely used open-source software.
Key facts
As stated in the sources, with where to find them.
- Competitors' systems discovered 22 unique synthetic vulnerabilities and patched 15 of those (11 unique patches for C challenges, 4 for Java).DARPA release, results paragraph
- Systems also found one real-world bug in SQLite3, disclosed under SQLite's guidelines.Same paragraph
- AIxCC received nearly 40 cyber reasoning system submissions; the seven top-scoring teams were to be awarded $2 million each and advance to the final.DARPA releases of 2024-07-17 and 2024-08-11
- Finalists must release their CRSs under an OSI-approved open-source license after the Final Competition.DARPA release, closing paragraph
Findings that cite this record
Key questions this bears on
- Is AI shifting the balance between finding and fixing vulnerabilities?Discovery is ahead. AI finds real vulnerabilities faster than they are fixed, and simple checks overstate how often AI patches work.
Sources
Related records
Aug 8, 2025
Aug 9, 2023
Feb 7, 2026
July 2024
May 21, 2025
Mar 9, 2026