CyphrQDARPA AI Cyber Challenge Results: What AI Found and Fixed in 2025
DARPA's AI Cyber Challenge final: AI systems found 54 of 63 planted bugs, patched 43, and found 18 real ones. What it shows and what it doesn't.
DARPA's AI Cyber Challenge (AIxCC) ended in August 2025 with AI systems finding and fixing security flaws in open-source code. DARPA reports the systems found 54 of 63 planted vulnerabilities, patched 43, and also found 18 real ones. Team Atlanta won. As of 26 October 2026, the AIxCC archive lists all seven finalist systems as open-source repositories.
Those are the headline DARPA AI Cyber Challenge results. This post covers what the official figures say, what they do not prove about real-world software, and what security teams can do with the released tools.
What was the DARPA AI Cyber Challenge?
AIxCC was a two-year competition run by DARPA, the US Defense Advanced Research Projects Agency, together with ARPA-H, the US health research agency. Teams built what DARPA calls a cyber reasoning system (CRS): software that analyses a codebase, finds vulnerabilities and writes patches for them.
The semifinal ran in August 2024. The final results were announced at DEF CON 33 on 8 August 2025. Seven teams reached the final, according to DARPA's finalist announcement of 8 July 2025: 42-b3yond-6ug, All You Need IS A Fuzzing Brain, Lacrosse, Shellphish, Team Atlanta, Theori and Trail of Bits.
The scoring used "synthetic" vulnerabilities: flaws deliberately inserted into open-source projects so that finding and fixing them could be measured. Any genuine, previously unknown flaws the systems found along the way were counted separately.
Who won AIxCC?
| Place | Team | Prize |
|---|---|---|
| 1st | Team Atlanta | $4 million |
| 2nd | Trail of Bits | $3 million |
| 3rd | Theori | $1.5 million |
DARPA's 8 July 2025 finalist announcement gives the final-round prize money as $8.5 million in total. On compute, DARPA's 8 August 2025 results release says Anthropic, Google and OpenAI each donated $350,000 in large language model credits for the final, which is $50,000 per team from each company, and Microsoft provided Azure credits.
What did the AI systems find and fix?
These figures are from DARPA's results release of 8 August 2025:
| Measure | Final (August 2025) | Semifinal (August 2024) |
|---|---|---|
| Synthetic vulnerabilities in scored challenges | 63 | — |
| Unique synthetic vulnerabilities found | 54 (86%) | 37% |
| Synthetic vulnerabilities patched | 43 (68%) | 25% |
| Real, previously unknown vulnerabilities found | 18 (6 in C, 12 in Java) | — |
| Patches for those real vulnerabilities | 11 | — |
| Code analysed | more than 54 million lines | — |
One detail worth knowing: DARPA's release carries an editor's note saying an earlier version wrongly gave 70 challenges. The corrected figure is 63, so some coverage still quotes the old number.
DARPA says the 18 real vulnerabilities are being disclosed to the open-source maintainers. In practice, that means the projects' own teams decide whether and how to fix them, on their own timelines.
How fast and how cheap were the AI patches?
DARPA reports an average of 45 minutes to submit a patch, and an average cost of about $152 per competition task. For comparison, the release notes that bug bounties range from hundreds to hundreds of thousands of dollars.
Some other details from the release: four teams submitted one-line patches, three teams scored on three challenge tasks within one minute, and one team scored with a patch over 300 lines long.
Read the $152 carefully. It is a competition figure for the systems' work on a task. The page I read doesn't break it down, and it is not the full cost of fixing a bug in your organisation, which also includes review, testing, release and deployment.
What was released as open source?
DARPA said all seven finalist systems would be released under a licence approved by the Open Source Initiative, with four available on the day of the results. The AIxCC archive now lists repositories for all seven, each with a semifinal and a final version:
| Team | System name |
|---|---|
| Team Atlanta | Atlantis |
| Trail of Bits | Buttercup |
| Theori | RoboDuck |
| Shellphish | Artiphishell |
| All You Need IS A Fuzzing Brain | Fuzzing Brain |
| 42-b3yond-6ug | Bug Buster |
| Lacrosse | Lacrosse |
The archive also lists supporting tools: SHERPA, which generates fuzzing harnesses for attacker-controlled entry points; the competition API used in the final; a finals scoring pipeline; and a challenge repository visualiser. The archive page itself doesn't state licences, so check each repository's licence file before you use it.
Does AIxCC prove AI can find all software bugs?
- 86% of planted bugs is not 86% of all bugs. Synthetic vulnerabilities are inserted so they can be scored. Real software holds flaws nobody has catalogued, so there's no denominator to measure against.
- A patch that scores is not a patch that ships. The competition judged patches automatically. DARPA reports 11 patches for the 18 real vulnerabilities; the release doesn't say how many maintainers accepted.
- It's not a product. These are research systems. Running one takes fuzzing infrastructure, language-model access and budget.
- Defenders don't get exclusive use. The systems are open source. Anyone can study them, which is good for defenders and also means attackers can learn from the same code. The advantage goes to whoever acts on the findings first.
What happens next with AIxCC?
- Disclosure outcomes. Whether CVE records appear for the 18 real vulnerabilities, and how quickly maintainers ship fixes. As of 26 October 2026, I found no public tally on DARPA's results release or the AIxCC archive page.
- ARPA-H's follow-on prizes. DARPA's results release of 8 August 2025 said ARPA-H was co-funding $1.4 million in prizes for teams to integrate AIxCC technology into software relevant to critical infrastructure. I haven't seen a later update on those prizes.
- Maintenance after the prize. Open-source research code often goes quiet after a competition. Watch commit activity on the seven repositories.
- Released data. DARPA said the competition framework, challenges and telemetry would follow. The archive lists infrastructure, challenges and a benchmark called CRUMBS, without links on the page as of 26 October 2026.
Going deeper: for security and IT teams
What a CRS combines. From the released tooling, the shape of these systems is visible: automated harness generation (SHERPA), fuzzing (automatically generating inputs to make a program fail), and language models for reasoning about code and writing fixes, paid for with the donated model credits. A fuzzer gives you a crashing input, which is proof a flaw is reachable. The model proposes a fix. The fix is then re-tested against that input. That loop of evidence, then patch, then re-test, is what made automatic scoring possible.
Where it fits your process. NIST's Secure Software Development Framework, SP 800-218 (version 1.1, February 2022) sets out practices for reviewing and testing code and for responding to vulnerabilities. An AI system that finds and patches flaws sits inside those practices, not outside them. It adds a source of findings and draft fixes. It does not replace triage, review or release control.
Controls for AI-generated patches. Treat each patch as an untrusted contribution from an outside developer: - Require a reproducer: the input or test that triggers the flaw, committed alongside the fix. - Require regression tests to pass, and add the reproducer to them. - Keep branch protection and mandatory human review on. No direct pushes from the tool's account. - Give the tool its own identity with the least access it needs, and log what it changes.
Isolate the analysis. Fuzzing runs the target code with hostile inputs. Run any CRS in an isolated environment with no production credentials, no secrets in environment variables and restricted outbound network access. Our post on AI coding assistants covers why model-driven tools should never sit near a .env file.
Know where your code goes. These systems send code to language-model providers. Before pointing one at private code, confirm which provider receives it, under what retention and training terms, and in which region.
Prioritise what it finds. A tool that finds more bugs adds to the queue. Rank its findings the way you rank any others; our guide to CVSS, EPSS and KEV explains how, and how to read a CVE record covers the records the 18 disclosures may become.
Report what you find upstream. If a tool finds a flaw in an open-source dependency, follow that project's published security policy and disclose privately first.
A pilot that produces evidence. Pick one internal C or Java repository with a decent test suite. Run one released CRS in isolation for a fixed period. Measure confirmed true findings, false positives, the share of patches your reviewers would accept, time spent reviewing, and total model cost. Compare against your existing static analysis and fuzzing on the same code.
Questions for any vendor selling "AI that finds and fixes vulnerabilities": - Were your results measured on planted bugs or real ones, and on whose code? - What is your false-positive rate, and how was it measured? - Does every finding come with a reproducer? - Which model provider sees our code, and what are the retention terms?
A checklist before you try AI vulnerability repair
- Start in isolation, with no secrets and limited network access.
- Demand a reproducer with every finding and every patch.
- Keep human review and branch protection on, without exceptions for the tool.
- Measure acceptance, not just volume.
- Disclose upstream through each project's security policy.
Learn more
Key takeaways
- Team Atlanta won AIxCC's $4 million first prize; Trail of Bits and Theori placed second and third.
- DARPA reports 54 of 63 synthetic vulnerabilities found (86%) and 43 patched (68%), up from 37% and 25% at the 2024 semifinal.
- The systems also found 18 real vulnerabilities in more than 54 million lines of code, with 11 patches.
- Average patch time was 45 minutes; average cost was about $152 per task.
- All seven finalist systems are listed in the AIxCC archive as open-source repositories.
- Planted-bug scores don't measure real-world coverage. Treat AI patches as untrusted contributions with reproducers and human review.
Companies are named in this post as competition participants and sponsors. It is not investment advice.
Sources
- DARPA, AIxCC final results news release (with editor's note on the challenge count), 8 August 2025.
- DARPA, news release announcing the seven finalists and final prize money, 8 July 2025.
- AIxCC, Archive of finalist cyber reasoning systems and competition tools, accessed 26 October 2026.
- NIST, SP 800-218: Secure Software Development Framework (SSDF) Version 1.1, February 2022.