The public evidence does not show AI giving attackers or defenders a lasting lead in cybersecurity. What the record shows is a speed contest: AI systems can find and patch software flaws on their own, as DARPA's AI Cyber Challenge demonstrated in August 2025, and Canada's cyber agency warned on June 24, 2026 that the same capability can cut the time defenders have to respond from days or weeks to hours. The practical result is that organizations with slow patching lose ground, whichever side has the better model.
Key takeaways
- DARPA's AI Cyber Challenge final, held at DEF CON on August 8, 2025, tested autonomous systems that both find and patch software vulnerabilities; Team Atlanta won with 392.8 points against 219.4 for the runner-up.
- Google's Big Sleep agent found an exploitable SQLite flaw before it shipped in a release, but its authors said a target-specific fuzzer would likely do at least as well.
- Canada's federal cyber security authority stated on June 24, 2026 that frontier AI models help threat actors find and exploit flaws much faster.
- The authority's main advice is not exotic: prompt patching, phishing-resistant multi-factor authentication, central logging, and segmentation.
- Competition results are not field results, and published counts of real vulnerabilities found in the DARPA final differ between sources.
What DARPA's contest measured
The AI Cyber Challenge ran for two years. Its seven finalist teams built cyber reasoning systems that had to read open-source code, prove that a vulnerability exists, and write a patch, all without a human operator. In the final, organizers built 63 vulnerabilities (40 in C, 23 in Java) into open-source projects, most of them manually crafted and modeled on historical flaws. Each team received USD 85,000 in cloud computing credits and USD 50,000 in language model credits, and the competition ran about 143 hours.
Scores combined several things: proving a flaw (one to two points), patching it (three to six points), assessing static analysis reports, and bundling a proof with its fix. Points decayed over time, so speed counted, and an accuracy multiplier penalized wrong submissions. Team Atlanta finished first with 392.8 points, Trail of Bits second with 219.4, and Theori third with 210.7. Prizes were USD 4 million, USD 3 million, and USD 1.5 million. The finalists' systems were released as open source afterward.
What the contest does not show
An academic analysis of the competition, written by researchers connected to the competition and explicitly not an official DARPA statement, lists the limits. Telemetry from the event was incomplete, which makes it hard to say which techniques caused which results. Baseline comparisons ran under ideal laboratory conditions. System failures and infrastructure bugs distorted some scores, so a low score does not prove a weak method. Whether a patch is semantically correct, meaning it fixes the flaw without breaking the program, was described as an open problem.
The same paper reports that plain parallel fuzzing, an older automated testing technique, found 34 of the 63 planted vulnerabilities, so roughly half were within reach of methods that use no language model. Teams also reported previously unknown flaws in real projects and disclosed them to maintainers, but published accounts give different totals, so no single figure is used here.
A real find, with the authors' own caution
On November 1, 2024, Google's Project Zero described how Big Sleep, an agent built with Google DeepMind, found a stack buffer underflow in SQLite, a database engine used in many products. The developers fixed it the same day it was reported, in early October, before an official release, so users were not affected. The authors called the work highly experimental. They wrote that a target-specific fuzzer would likely be at least as effective, and that the flaw had escaped the project's own testing and Google's OSS-Fuzz service. An AFL run of 150 CPU-hours also missed it, though the authors noted AFL is not well suited to SQL text inputs.
The offense side, as a government agency describes it
On June 24, 2026, Canada's federal cyber security authority, a unit of the Communications Security Establishment, issued a statement on frontier AI models. It said these models can help threat actors find and exploit vulnerabilities, including software flaws and weaknesses in security controls, much faster than before, and that defender response time can shrink from days or weeks to hours. It added that threat actors already use AI to produce more convincing phishing, voice-call scams, and deepfake impersonation, to chain vulnerabilities, and to let less skilled actors carry out more sophisticated attacks. The statement points back to the authority's National Cyber Threat Assessment 2025-2026, released October 30, 2024, which already assessed that AI lowers barriers to malicious activity.
This is an agency assessment, not a measured count of attacks. It gives no number of incidents attributed to AI, and the statement should be read as a warning about direction and speed.
Evidence side by side
| Evidence | Favors | Main limit |
|---|---|---|
| DARPA AI Cyber Challenge final, August 2025 | Defense: systems found and patched flaws without operators | Planted vulnerabilities, lab conditions, incomplete telemetry |
| Big Sleep and SQLite, November 2024 | Defense: a flaw caught before release | One case; authors say a tailored fuzzer may match it |
| Canadian cyber authority statement, June 24, 2026 | Offense: faster discovery, shorter response windows | Assessment of capability, no incident counts |
| Canadian national threat assessment, October 30, 2024 | Offense: lower barriers, more persuasive social engineering | Forward-looking judgment |
What the agency tells organizations to do
The authority's advice in the June 2026 statement is practical. Use AI on the defense side to identify exposures earlier, test controls, and find vulnerabilities during software development. Apply security patches promptly, limit internet exposure, use phishing-resistant multi-factor authentication, centralize logs, segment key systems, address unsupported legacy systems, and test incident response plans. Set clear rules on the use of AI tools by staff, including how sensitive information is handled, and make sure third-party providers meet the same standard. Suspected incidents should be reported as soon as possible. The agency frames resilience as a leadership matter, not only an IT task.
None of this is a legal requirement in itself. The statement is guidance, and duties under privacy, sector, or contract law are separate questions. This article is general information, not legal advice.
FAQ
Has AI made hacking easier?
Canada's cyber agency assesses that it has lowered barriers and speeded discovery of flaws. The public evidence is an agency judgment and research results, not a count of AI-driven breaches.
Can AI patch software without people?
In DARPA's contest, the finalist systems submitted working patches with no human operator. Their authors say that deciding whether a patch is semantically correct remains an open problem, so review by engineers still matters in practice.
Is the DARPA competition proof that defenders will win?
No. The vulnerabilities were planted, the conditions were controlled, and the contest scored both sides of the work, finding and fixing. It shows capability, not who holds the advantage in the field.
What is the cheapest defense against faster attacks?
The agency lists the basics first: apply patches promptly, use phishing-resistant authentication, and keep central logs. A shorter response window raises the cost of delay.
Related reading
- How AI is used in security measures
- The threat-or-tool debate on AI
- Canadian rules on AI
- Ethical dilemmas in AI
More in AI Policy and Ethics.
Last verified: October 2026
Sources
- Statement on frontier AI models and their impact on cyber security, Communications Security Establishment Canada, June 24, 2026
- From Naptime to Big Sleep, Google Project Zero and Google DeepMind, November 1, 2024
- SoK: DARPA's AI Cyber Challenge (AIxCC), Zhang C et al., arXiv 2602.07666, February 7, 2026
- Trail of Bits' Buttercup wins 2nd place in AIxCC Challenge, Trail of Bits, August 9, 2025
- National Cyber Threat Assessment 2025-2026, Communications Security Establishment Canada, October 30, 2024