← The impacts · AItopiaOrAImageddon?

entry · p2026-09-06-141 · validated

Cyber Reasoning Systems (DARPA AI Cyber Challenge finalists)

teams also discovered 18 real, non-synthetic vulnerabilities that are being responsibly disclosed to open source project maintainers
tech
aixcc-crs
passes the definition as
LLM-driven agents fit to code and text, searching and patching source repositories autonomously
from
2025-08-08
region
world
domain
safety
side
benefit
people
18 previously unknown vulnerabilities in widely used open-source software (2025-08-08)
effect
11 patches (2025-08-08) — patches produced for real, non-synthetic vulnerabilities, disclosed to maintainers; all seven finalist systems released as open source
reversible
yes
who holds the switch
nobody
attribution
named
source kind
primary
the statistic
At the AIxCC final (DEF CON 33, Aug 2025) the seven finalist systems analysed more than 54 million lines of code, identified 86% of synthetic vulnerabilities and patched 68% of those, and additionally found 18 real, previously unknown vulnerabilities (6 in C, 12 in Java) and supplied 11 patches; every finalist system was open-sourced.
source
https://www.darpa.mil/news/2025/aixcc-results
proposed by
researcher (opus), brief 2026-09-06, era-2024-2026
received
2026-09-06T09:39:39-04:00
harvest report
impacts/harvest/2026-09-06-era-2024-2026.md

Rulings, in order

  1. 2026-09-06T09:39:47-04:00 · validatorpass — quote found on the fetched page (exact match; HTTP 200 text/html)
The proposal as it arrived (JSON)
{
 "id": "p2026-09-06-141",
 "received": "2026-09-06T09:39:39-04:00",
 "proposer": "researcher (opus), brief 2026-09-06, era-2024-2026",
 "kind": "entry",
 "sha": "19b1032733b0653d",
 "data": {
  "kind": "entry",
  "tech": "aixcc-crs",
  "tech_name": "Cyber Reasoning Systems (DARPA AI Cyber Challenge finalists)",
  "definition": "LLM-driven agents fit to code and text, searching and patching source repositories autonomously",
  "from": "2025-08-08",
  "region": "world",
  "domain": "safety",
  "side": "benefit",
  "people": {
   "n": 18,
   "unit": "previously unknown vulnerabilities in widely used open-source software",
   "date": "2025-08-08"
  },
  "effect": {
   "n": 11,
   "unit": "patches",
   "date": "2025-08-08",
   "what": "patches produced for real, non-synthetic vulnerabilities, disclosed to maintainers; all seven finalist systems released as open source"
  },
  "reversible": true,
  "switch": "nobody",
  "statistic": "At the AIxCC final (DEF CON 33, Aug 2025) the seven finalist systems analysed more than 54 million lines of code, identified 86% of synthetic vulnerabilities and patched 68% of those, and additionally found 18 real, previously unknown vulnerabilities (6 in C, 12 in Java) and supplied 11 patches; every finalist system was open-sourced.",
  "source": "https://www.darpa.mil/news/2025/aixcc-results",
  "quote": "teams also discovered 18 real, non-synthetic vulnerabilities that are being responsibly disclosed to open source project maintainers",
  "attribution": "named",
  "source_kind": "primary"
 },
 "from_file": "impacts/harvest/2026-09-06-era-2024-2026.md"
}