Loading story…
DARPA’s AI Cyber Challenge demonstrated autonomous systems can find and repair flaws in critical-infrastructure open-source software: finalists analyzed more than 54 million lines across 63 challenges, discovered 54 synthetic vulnerabilities, patched 43, and identified 18 real vulnerabilities undergoing responsible disclosure. Team Atlanta—Georgia Tech, Samsung Research, KAIST, and POSTECH—won the competition; DARPA and ARPA-H plan to transition the technology and open-source all seven finalist systems.
Aarno Labs separately demonstrated AI-assisted remediation on CVE-2018-18732 in Tenda AC18 firmware, where the ntpServer CGI parameter reaches a 260-byte stack buffer through an unchecked strcpy, enabling overwrite of saved control-flow state. A language model produced a 12-byte binary patch replacing the copy with a 256-byte-bounded strncpy, and CodeHawk reportedly discharged the resulting write-bound proof obligation; however, Aarno Labs cautioned that the verified change fixes only this flaw and noted another undisclosed API-contract misuse in shared library code.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
During the August 2024 semifinals, AIxCC systems identified 37% of synthetic vulnerabilities and patched 25% of those identified.
Aarno Labs reported identifying a second, more serious API-contract misuse in shared library code shared across product lines, but did not disclose technical details or establish reachability from fromSetSysTime.
Aarno Labs analyzed CVE-2018-18732 in the Tenda AC18 httpd binary, where an attacker-controlled ntpServer parameter reaches strcpy into a 260-byte stack buffer in fromSetSysTime. A language-model-generated three-instruction patch replaced strcpy with strncpy using a 256-byte bound, and CodeHawk reportedly discharged the destination write-bound obligation without lost invariants elsewhere in the function.
During the final competition, teams found 18 real non-synthetic vulnerabilities and submitted 11 patches; one C-code vulnerability was patched independently by maintainers. DARPA said four finalist cyber reasoning systems were released immediately as open source and added $1.4 million in transition prizes.
DARPA announced Team Atlanta as the winner of the two-year AI Cyber Challenge, with Trail of Bits and Theori placing second and third. The finalist systems analyzed 63 challenges spanning more than 54 million lines of code, discovering 54 synthetic vulnerabilities and patching 43 of them.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers and industry commentators warned that AI is rapidly accelerating patch analysis and vulnerability discovery, making it easier to extract exploit-relevant details from public fixes before many organizations can remediate. Reporting on recent research highlighted how large language models and automated patch-diffing can identify patched executables, vulnerable functions, and likely root causes from vendor updates, while Linux-focused analysis said similar techniques can infer affected components and even help reproduce proof-of-concept conditions from public patches. Examples cited include Akamai’s **PatchDiff-AI** work on Windows updates and **K-Repro** research that reproduced dozens of `KernelCTF` vulnerabilities from patch data. The coverage said defenders are struggling with incomplete vulnerability intelligence and weak automation inputs, especially when advisories lack timely, machine-readable metadata. One example involved **CVE-2026-7473** in **Arista EOS**, which was reportedly exploited in the wild but did not appear in public CVE databases for about a month after Arista published its advisory; Arista also issued configuration-based mitigations rather than a software patch, limiting the usefulness of version-only scanners. The reports argued that organizations need stronger configuration monitoring, intrusion detection, threat hunting, and better vendor support for structured advisory formats such as **CSAF** to keep pace with AI-enabled attackers.
Aug 1, 2026
Akamai researchers have developed an AI-driven tool, PatchDiff-AI, designed to automate the root cause analysis of vulnerabilities patched during Microsoft's regular Patch Tuesday updates. This system leverages large language models in a multi-agent configuration to rapidly analyze patched binaries, identify the underlying security flaws, and generate detailed reports, including attack vector analysis and exploitability. The tool demonstrated over 80% success in fully automated report generation, significantly accelerating the defensive response to newly disclosed vulnerabilities. A recent case study applied PatchDiff-AI to CVE-2025-60719, a use-after-free vulnerability in the Windows Ancillary Function Driver (afd.sys) for Winsock, which affects nearly all supported Windows versions. The flaw allows local privilege escalation by enabling a low-privilege attacker to manipulate kernel memory and gain system privileges. Microsoft addressed the issue by introducing a synchronization barrier to prevent unsafe unbinding of socket endpoints during critical operations. The research and tool were presented at Black Hat Europe Arsenal, highlighting the growing role of AI in vulnerability analysis and mitigation.
Jun 29, 2026
European and national cyber authorities are warning that AI is rapidly increasing the speed and scale of vulnerability discovery and exploit development, raising the prospect of a sustained remediation crisis. The European Central Bank told about 110 major banks to assess AI-enabled cyber threats and submit action plans by **October 31, 2026**, while the European Systemic Risk Board and European Supervisory Authorities issued parallel warnings on systemic risk from frontier AI models. In France, ANSSI Director General Vincent Strubel told senators that AI-assisted discovery could create a multi-year **"patch wall"**, overwhelming remediation teams even as basic controls such as network segmentation, identity and access management, and timely patching remain the most effective defenses. Industry reporting and vendor disclosures show why regulators are escalating. Mozilla said frontier AI models helped identify **271 vulnerabilities** fixed in Firefox 150 after an earlier run found 22 security-sensitive bugs, while researchers and commentators say LLM-assisted patch diffing can shrink the path from a disclosed `CVE` to a working proof of concept to days or even hours, including for flaws such as `CVE-2025-32433` in Erlang/OTP SSH. At the same time, access controls around advanced cyber-capable models are tightening unevenly: Anthropic expanded its restricted **Project Glasswing** program for Claude Mythos to critical-infrastructure organizations, but open-weight alternatives such as Zhipu AI's **GLM-5.2** are reported to deliver competitive vulnerability-finding performance at lower cost, reinforcing concerns that powerful offensive-relevant capability is spreading faster than most enterprises can patch.
Jul 10, 2026