Seven teams advanced to the final after the DARPA AI Cyber ​​Challenge (AIxCC) semifinal competition was held last week at DEF CON 32. The advancing teams each received a prize of $2 million and will participate in the final competition in August 2025.

A partnership between DARPA and the Advanced Research Projects Agency for Health (ARPA-H), the AIxCC competition had teams design AI systems to secure open-source infrastructure software used across the private and public sectors in industries such as finance, utilities, and healthcare. These systems are vulnerable to cyberattacks due to their large attack surface and widespread lack of security tools, and many have been targeted recently, underscoring the urgent need to protect critical infrastructure.

The competition asked teams to develop Cyber ​​Reasoning Systems that could find and fix vulnerabilities in a set of Challenge Projects designed by AIxCC experts. Nearly 40 teams submitted systems. The competitors’ systems discovered 22 unique synthetic vulnerabilities in the Challenge Projects and patched 15 of them. The systems found 11 unique patches for C-based challenges and 4 for Java-based challenges. One real bug was found in SQLite3, and it was disclosed.

“In true DARPA style, we didn’t know if our hypothesis would be proven when we launched this program. Now we’ve seen that AI systems can not only identify vulnerabilities, but also patch them to protect the code that underpins critical infrastructure,” Andrew Carney, program manager for AIxCC, said in a statement.

The following teams will advance to the final:

Teams will have one year to develop their technology for the finals. AIxCC will distribute $29.5 million in prize money to the teams judged to create the most effective systems, and winners must release their systems as open-source software after the competition.