Kicking off AIxCC’s Finals with Buttercup

Summary: DARPA's AI Cyber Challenge has moved into its finals, where teams like Trail of Bits' Buttercup now get $1,000 or more per challenge instead of the semifinals' $100, can build custom AI models rather than relying only on Anthropic, OpenAI, and Google models, and control their own Azure infrastructure. The finals add three unscored exhibition rounds before a scored round in late June, with results at DEF CON 2025 in August, and expand from one challenge type to three: a codebase with a single vulnerability-introducing diff, a flat codebase requiring wider analysis, and SARIF static analysis alerts that may be true or false positives.
What's compelling: The competition now rewards systems that find and patch vulnerabilities across code review, static analysis, and fuzzing inputs, with patches scored substantially higher than discovery alone - the same mix a security team faces, and one where a tool that only flags crashes without fixing root causes leaves the work undone.

Read the original at Trail of Bits Blog ↗