At the end of the DARPA competition, we expected it would take at least one to five years for an artificial intelligence (AI) model with human-level abilities to appear, but it became reality in just six months. Figuring out how to fully leverage AI to solve the problems at hand has become every organization's assignment.
Kim Tae-su, Microsoft (MS) corporate vice president for security and a professor of computer engineering at the Georgia Institute of Technology, said this in a keynote at SMARTCLOUD SHOW 2026, held on the theme of "AI moves the world" at the Westin Josun Hotel in Sogong-dong, Seoul, on the 26th. Kim gave a lecture titled "Hyperscale bug finding: from DARPA AIxCC to Microsoft MDASH."
Kim said advances in AI technology are fundamentally reshaping the cybersecurity landscape. Citing MS's monthly vulnerability statistics, Kim said, "After an analysis in March concluded that frontier AI models had surpassed the abilities of human hackers, the number of vulnerabilities increased vertically," and added, "As AI models improve, we can build safer software, but at the same time, there is a much greater chance that more vulnerabilities will be found." The contest between the AI spear and the AI shield in cyberspace has already begun.
Kim led Team Atlanta, the winning team of last year's AI Cyber Challenge (AIxCC) organized by the Defense Advanced Research Projects Agency (DARPA). AIxCC is a competition that uses AI to automatically analyze, detect, and fix vulnerabilities. Team Atlanta scored a total of 392.76 points in the finals, winning first place by an overwhelming margin of more than 170 points over the runner-up. Researchers from Georgia Tech, KAIST, and Pohang University of Science and Technology POSTECH and others took part as team members from Korea and abroad, and the fact that 80% to 90% of the team were Korean is meaningful.
The cyber reasoning system (CRS) developed by Team Atlanta automatically detected the various types of vulnerabilities used in the competition and successfully patched many of them in real time. In the finals, it analyzed 28 open-source projects and found 54 of the 70 vulnerabilities hidden by the organizers. Most vulnerabilities were fixed within an hour, and 18 previously unknown zero-day vulnerabilities were also discovered. The share of discovered vulnerabilities that were confirmed to be real exceeded 90%.
It also showed higher efficiency than humans in terms of expense. Kim said, "It cost about $152 per successful task," and added, "If you assign code audits or penetration tests to people, you need 100 to 1,000 times more expense than that." Kim added, "The fact that we can perform expert-level security audits and vulnerability detection at low expense even on a code repository we encounter for the first time signifies an important change for the security industry."
However, Kim noted that there were limits to analyzing massive codebases with a single AI. Individual AIs had strong reasoning abilities, but their performance varied widely by task, sometimes giving irrelevant answers to simple questions. To address this, he said they introduced a "multi-agent" architecture in which multiple AI agents collaborate based on their roles and context. Instead of assigning all work to a single AI, they deployed specialized agents for each task, such as vulnerability hunting, static analysis, verification, and patch generation.
Kim said, "Large language models (LLMs) have superhuman abilities but are like entities that do not know how to use them," and added, "To apply LLMs to security work, we need to distinguish between what LLMs do well and what they do poorly, and design systems to maximize their strengths." He added, "How to amplify the superhuman abilities of LLMs and apply them to security work was a key challenge of the competition."
Kim also led development at MS of MDASH, an AI vulnerability detection system. MDASH combines the strengths of multiple AI models and implements security experts' analytical processes as multi-agent workflows. After building a threat model based on software architecture and past vulnerabilities, more than 100 sub-agents search for weaknesses. Agents playing the roles of hackers, developers, and defenders verify the discovered vulnerabilities, and MDASH even generates proof-of-concept (PoC) code that confirms real-world exploitability and produces remediation patches.
Kim said, "When agents with different perspectives go through a process of reaching consensus, they can more accurately distinguish real vulnerabilities from false positives," and explained, "Among the vulnerabilities MDASH found are high-risk issues where an external attacker could potentially seize the highest system privileges simply by sending packets."
Kim added, "MDASH, even while combining AI models that are two generations older, achieved performance comparable to the latest frontier models such as Mythos Preview, and it is proving its capabilities not only on benchmarks but also in real software development environments," and said, "It is significant that expert-level vulnerability analysis is possible at far lower expense than when people were tasked with security audits or penetration tests in the past."