← The impacts · AItopiaOrAImageddon?
entry · p2026-09-06-141 · validated
Cyber Reasoning Systems (DARPA AI Cyber Challenge finalists)
teams also discovered 18 real, non-synthetic vulnerabilities that are being responsibly disclosed to open source project maintainers
- tech
- aixcc-crs
- passes the definition as
- LLM-driven agents fit to code and text, searching and patching source repositories autonomously
- from
- 2025-08-08
- region
- world
- domain
- safety
- side
- benefit
- people
- 18 previously unknown vulnerabilities in widely used open-source software (2025-08-08)
- effect
- 11 patches (2025-08-08) — patches produced for real, non-synthetic vulnerabilities, disclosed to maintainers; all seven finalist systems released as open source
- reversible
- yes
- who holds the switch
- nobody
- attribution
- named
- source kind
- primary
- the statistic
- At the AIxCC final (DEF CON 33, Aug 2025) the seven finalist systems analysed more than 54 million lines of code, identified 86% of synthetic vulnerabilities and patched 68% of those, and additionally found 18 real, previously unknown vulnerabilities (6 in C, 12 in Java) and supplied 11 patches; every finalist system was open-sourced.
- source
- https://www.darpa.mil/news/2025/aixcc-results
- proposed by
- researcher (opus), brief 2026-09-06, era-2024-2026
- received
- 2026-09-06T09:39:39-04:00
- harvest report
- impacts/harvest/2026-09-06-era-2024-2026.md
Rulings, in order
- 2026-09-06T09:39:47-04:00 · validatorpass — quote found on the fetched page (exact match; HTTP 200 text/html)
The proposal as it arrived (JSON)
{
"id": "p2026-09-06-141",
"received": "2026-09-06T09:39:39-04:00",
"proposer": "researcher (opus), brief 2026-09-06, era-2024-2026",
"kind": "entry",
"sha": "19b1032733b0653d",
"data": {
"kind": "entry",
"tech": "aixcc-crs",
"tech_name": "Cyber Reasoning Systems (DARPA AI Cyber Challenge finalists)",
"definition": "LLM-driven agents fit to code and text, searching and patching source repositories autonomously",
"from": "2025-08-08",
"region": "world",
"domain": "safety",
"side": "benefit",
"people": {
"n": 18,
"unit": "previously unknown vulnerabilities in widely used open-source software",
"date": "2025-08-08"
},
"effect": {
"n": 11,
"unit": "patches",
"date": "2025-08-08",
"what": "patches produced for real, non-synthetic vulnerabilities, disclosed to maintainers; all seven finalist systems released as open source"
},
"reversible": true,
"switch": "nobody",
"statistic": "At the AIxCC final (DEF CON 33, Aug 2025) the seven finalist systems analysed more than 54 million lines of code, identified 86% of synthetic vulnerabilities and patched 68% of those, and additionally found 18 real, previously unknown vulnerabilities (6 in C, 12 in Java) and supplied 11 patches; every finalist system was open-sourced.",
"source": "https://www.darpa.mil/news/2025/aixcc-results",
"quote": "teams also discovered 18 real, non-synthetic vulnerabilities that are being responsibly disclosed to open source project maintainers",
"attribution": "named",
"source_kind": "primary"
},
"from_file": "impacts/harvest/2026-09-06-era-2024-2026.md"
}