AIxCC finals: Tale of the tape
Summary: DARPA's AI Cyber Challenge finals will name a winner this week for the $4 million first prize for the best AI system that automatically finds and fixes vulnerabilities in real-world code, with seven finalists split among four university teams and three private companies, all based in the US. The teams divide into three camps: those rooted in fuzzing and static analysis enhanced with LLMs (Trail of Bits, Shellphish, LACROSSE), those using LLMs as the primary reasoning engine (all_you_need_is_a_fuzzing_brain, Theori), and those balancing both (Team Atlanta, 42-b3yond-6ug).
What you should know: PoV-plus-patch combinations earn significantly higher scores than patches alone, and PoVs can be used to break other teams' patches and cut their accuracy multipliers - so the final ranking turns on how aggressively each team gambles on speculative patches, with Theori submitting up to two unconfirmed patches for every confirmed one.
Read the original at Trail of Bits Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026