Georgia Tech Researchers Share AI Cyber Challenge Lessons at USENIX Security 2026
What can artificial intelligence (AI) do to protect software from cyberattacks?
Georgia Tech researchers spent two years helping to answer that question through DARPA’s AI Cyber Challenge (AIxCC), a competition designed to test whether AI could identify and fix security vulnerabilities in real-world software.
Now, they are sharing what they learned with the cybersecurity community.
Their paper, SoK: DARPA’s AI Cyber Challenge (AIxCC): Competition Design, Architectures, and Lessons Learned, was presented at USENIX Security 2026, one of the world's leading cybersecurity conferences. The paper was selected as a runner-up for the conference’s distinguished paper award, placing it among 36 recognized papers from 362 accepted papers out of 3,028 submissions.
The paper examines how the seven finalist teams approached the competition and what the results reveal about the future of AI-powered cybersecurity.
Putting AI to the Test
AIxCC challenged teams to build Cyber Reasoning Systems (CRSs) that could operate with minimal human assistance to identify software vulnerabilities, develop fixes, and determine whether security alerts were real threats.
The teams had 143 hours to analyze 53 software projects during the final competition.
Georgia Tech’s Team Atlanta, which won the competition, used an approach that combined multiple AI agents with traditional security tools. Other teams used different approaches, including applying AI for specific tasks or building highly autonomous AI agents.
The variety of systems provided researchers with a rare opportunity to compare different approaches to AI-powered cybersecurity.
Lesson from the Competition
One of the biggest lessons was that reliability matters as much as intelligence.
Some systems were highly capable but struggled to remain operational while analyzing large, complicated software projects. The strongest systems were often those that could work reliably throughout the competition.
The researchers also found that AI and traditional security tools have different strengths. Traditional tools were still effective at finding common bugs, while AI performed better at reasoning through more complex problems.
However, AI-generated fixes remain a major challenge.
Researchers found that 38% to 46% of AI-generated patches were semantically incorrect. This means a patch might stop a security problem but also break a feature or create another problem.
The results show that AI can play an important role in cybersecurity, but human experts are still needed to verify the safety of AI-generated fixes.
Sharing the Lessons
Cen Zhang, the paper’s first author, said the research offers a unique look at the competition by combining lessons from the finalist teams, organizers, and DARPA’s data.
“This paper provides a unique angle on how AIxCC was designed, the techniques teams used, and what the scores reveal and conceal,” Zhang said.
Jiho Kim presented the paper at USENIX Security 2026. He said the presentation was an opportunity to share lessons from two years of work with the broader cybersecurity community.
“Seeing the strong interest and thoughtful questions from the audience made the experience particularly rewarding,” Kim said.
The researchers say they hope the lessons from AIxCC will help guide the next generation of cybersecurity tools.
