ATLANTIS
Team Atlanta, AIxCC winner
Cyber reasoning system mixing LLM agents with fuzzers and program analysis; each LLM-made input or patch is tested by running it.
The loop
- Proposes
Fuzz seeds, payload generator scripts and source patches, from LLM agents
- Judged by
Running the code: coverage, sanitizer crashes as proof of a bug, patch checks against crash and tests
- Steers
Coverage feedback refines scripts (up to four rounds); failed patches guide the next try; seeds join a corpus
Headline result
Won the DARPA AIxCC final at DEF CON 33 (August 2025) with 392.76 points; the team's paper reports 43 of 70 vulnerabilities found. DARPA's overall figures (all teams): 54 of 63 synthetic vulnerabilities found and 43 patched, 18 real-world bugs found, about $152 average per task.
What this does not prove
Scores and counts come from the team's own paper plus DARPA's page, which differ (70 versus 63 challenges after a DARPA correction). The competition used synthetic bugs inserted into open-source projects. Real-world finds are small in number.
How it generalizes the harness
The system is a program-analysis and fuzzing pipeline that calls LLM modules, and sanitizers and tests, not an LLM, decide whether a bug or patch counts.
Classification
| What it proposes | Code patch |
|---|---|
| Generative model | Several commercial LLMs used by agents (models vary by module) |
| Algorithmic authority | Fuzzers, sanitizers, PoV replay and project tests |
| Feedback | Test results |
| What gets updated | Prompt context |
| When it runs | At inference time |
| Validity | Empirical (measured) |
| Evidence | Experiments reported |
| Lineage | Original system |