DARPA prepares to assess top teams in DEF CON AI-cyber competition
The Defense Advanced Research Projects Agency is getting ready to evaluate seven competing teams’ cyber reasoning systems at an upcoming competition hosted by the Pentagon’s research giant at next week’s DEF CON hacker conference in Las Vegas.
In the final round, DARPA will determine the top three teams whose models can autonomously identify and patch vulnerabilities in open-source code. The artificial intelligence-powered systems are designed to secure the open-source software that underpins critical infrastructure sectors like water systems and financial institutions.
Open-source tools are free to use and implement, making them convenient for critical infrastructure owners and operators. But they’re particularly vulnerable to cyber exploitation because its publicly available code allows attackers to more easily identify and exploit weaknesses. If a hacker succeeds in infiltrating and leveraging a flaw, it could create cascading impacts on public health and safety.
The two-year competition was partly motivated by the advent of large language models that power popular consumer-facing generative AI tools. Many of the major companies that have rolled out such offerings, including Anthropic and OpenAI, provide their model infrastructure to competitors.
The seven finalist teams were selected at least year’s DEF CON. In recent weeks, during the finalist preliminary exhibition rounds, several teams discovered real code vulnerabilities that were not synthetically created for the competition, said Andrew Carney, the program manager for the DARPA AI Cyber Challenge, known as AIxCC.
Teams analyzed over 7.8 million lines of code in the third exhibition round, identifying 59% of synthetic vulnerabilities and patching 43%, he said.
“Since the initial announcement two years ago, we’ve been working with existing federal agencies, [non-governmental organizations] and just the utility owners themselves, in varying capacities, to identify the open source code bases that they are concerned about or interested in,” Carney told reporters in a call this week.
The goal, he said, is to assist critical infrastructure owners and operators in such a way that doesn’t force them to incur additional costs. As part of the competition’s rules, teams must agree to open-source their systems. That clause aims to accelerate the distribution and use of the AIxCC-developed technology within the cybersecurity and software development fields.
The final round will take inspiration in part from a Chinese hacking campaign discovered last year that was found to have burrowed into major U.S. telecommunications systems and their wiretapping platforms, DARPA’s Information Innovation Office director told Nextgov/FCW in May.
The competition offers $4 million for first place, $3 million for second, and $1.5 million for third. Winners will be announced next Friday.
