Findings/aixcc-systems-patched-most-found-bugs

In DARPA's AI Cyber Challenge, autonomous systems patched most of the synthetic vulnerabilities they found.

Qualifiedmeasured2 evidence records from 1 independent sourceassistant-drafted

Scope: what this does not show

Competition challenges; DARPA's own scoring.

Qualified: Still standing, but later work narrows how far it applies.

Evidence

Aug 11, 2024

AIxCC semifinal: AI systems find 22 synthetic vulnerabilities, patch 15, and find one real SQLite bug

DARPA

Aug 8, 2025

AIxCC final: Team Atlanta wins as systems patch 43 of 54 found synthetic bugs and find 18 real ones

DARPA

43 of 54 found synthetic vulnerabilities patched.

How it relates to other findings

supportsqualifiescontestssupersedes

ReportedCorroboratedQualifiedContestedSupersededRevalidate· node size = evidence records · columns group by topic

Select a finding to see how it relates to others. Arrows point from the newer finding to the one it supports, qualifies, contests, or supersedes.

Checking only that the original crash no longer reproduces overstates how often AI-generated patches actually fix the vulnerability. qualifies this findingThe AIxCC teams' agents lose much of their solve rate under stronger validation on PatchBench tasks; the competition's counted patches were not re-validated.

Status history

2024-08-11ReportedSemifinal results. · record
2026-02-07QualifiedA later review finds 16-21% of top patches semantically wrong. · record
2026-09-25QualifiedcorrectionThe 16-21% figure is competition-scored submission accuracy and does not reduce DARPA's 43 counted patches. The qualification now rests on PatchBench: agents from top AIxCC teams lose much of their solve rate under stronger-than-crash validation. · record

What would change this: Independent verification of competition patches.
Evidence kind: measured: An experiment or evaluation produced the number.
Freshness: Evidence 231d old · recheck in 309 daysNewest evidence Feb 7, 2026. Half-life 540 days.
Methods tested: AI vulnerability discovery for defense Automated patching
Topics: Vulnerability repair
Fide research: FID-088: Independent verification of autonomous cyber repairs

Cite this record

Fide AI. "In DARPA's AI Cyber Challenge, autonomous systems patched most of the synthetic vulnerabilities they found.." Agentic Cyber Explorer, record aixcc-systems-patched-most-found-bugs. https://agentic-cyber-explorer.pages.dev/findings/aixcc-systems-patched-most-found-bugs/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-aixcc-systems-patched-most-found-bugs,
  author = {{Fide AI}},
  title = {In DARPA's AI Cyber Challenge, autonomous systems patched most of the synthetic vulnerabilities they found.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/aixcc-systems-patched-most-found-bugs/},
  note = {Record aixcc-systems-patched-most-found-bugs; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.