Team Atlanta spent two years exploring how artificial intelligence (AI) could help identify and fix software security problems as part of the Defense Advanced Research Projects Agency (DARPA) AI Cyber Challenge (AIxCC).

After a grueling, world-class competition, the team won the $4 million first-place prize in August 2025. 

The team has since disbanded. Some members have moved into the corporate world, while others continue in academia. Despite these varied paths, Team Atlanta’s search for breakthrough AI cybersecurity solutions continues.

From AIxCC to Microsoft

Team Atlanta lead Taesoo Kim, principal security researcher Dongkwan Kim, and three other former team members joined Microsoft Security after the competition, where they continue to work on AI and cybersecurity in the Frontier Offensive Research & Generative Exploitation (FORGE) Lab.

The move has given the researchers an opportunity to apply concepts from AIxCC to real-world software. It has also exposed them to challenges that are difficult to replicate in a competition or research lab.

Dongkwan Kim said that team members continue to share what they learned through research papers, reports, software, and benchmarks. At Microsoft, these lessons are tested against real customer code.

This work led to MDASH, Microsoft's multi-agent, multi-model system for vulnerability discovery and remediation. The system uses more than 100 AI agents to search for vulnerabilities, validate potential findings, and help develop fixes.

Rather than asking a single AI model if a piece of code contains a vulnerability, MDASH can examine a problem using multiple agents. The system can also try to create an exploit to determine whether a potential vulnerability is real and reachable.

For Dongkwan Kim and the other former Team Atlanta members at Microsoft, moving from AIxCC to MDASH showed how research can look different when applied to real software.

“AIxCC was not an endpoint for Team Atlanta,” he said. “We continue sharing what we learned through technical reports, papers, open artifacts, and benchmarks for vulnerability discovery and patching.”

Working with customer code introduced new challenges for the Microsoft team. The researchers had to consider security boundaries, existing development processes, how findings would be reviewed, and how vulnerabilities would be prioritized for action.

These challenges created a new feedback loop between research and product development. The team took ideas from AIxCC, test them on real software, learn where they worked and where they fell short, and use those lessons to improve the system.

The experience also showed that AI does not replace the need for cybersecurity experts. Human researchers are still needed to provide context, decide how to break down difficult problems, validate findings, understand attack paths, and determine the potential impact of a vulnerability.

Taesoo Kim, a professor in the School of Cybersecurity and Privacy and vice president of security research at Microsoft, said the competition continues to influence the Microsoft team's work.

“Every single activity that we’ve done at Microsoft was influenced by AIxCC,” he said in a 2026 interview with Microsoft.

The work has continued to grow. In 2026, Microsoft introduced MAI-Cyber-1-Flash, an AI model built specifically for cybersecurity and designed to work with MDASH.

The model is designed to handle many of MDASH's tasks while allowing larger AI models to focus on harder problems. Microsoft reported that replacing 80% of the models used by MDASH with MAI-Cyber-1-Flash increased its performance on the CyberGym benchmark from 88.4% to 95.95%.

The benchmark includes more than 1,500 examples from 188 software projects. Microsoft also reported that the new setup can achieve similar performance at half the cost of the previous MDASH configuration.

“AIxCC has sparked cybersecurity innovation across the globe, from frontier AI companies to small academic labs,” said Taesoo Kim. “It is an incredibly exciting time to be working in AI-driven security engineering and research, as we see AI fundamentally reshape how we find and fix vulnerabilities at scale.”

Continuing the Research at Georgia Tech

The AIxCC experience also continues to shape cybersecurity research at Georgia Tech.

Jiho Kim, a Georgia Tech Ph.D. student who was part of Team Atlanta's research efforts, said one of the biggest lessons he’s brought back to campus was learning how AI and traditional security tools can work together.

One of these tools is fuzzing. Fuzzing tests software with large numbers of inputs to detect unexpected behavior or security problems. Large language models (LLMs), meanwhile, can reason about code and help guide the search.

During the AIxCC competition, the Team Atlanta combined these ideas in CtxFuzz, a system that uses an LLM to help guide fuzzing toward parts of software that may contain vulnerabilities.

The research was submitted to the ACM/IEEE International Conference on Automated Software Engineering, where it received the ACM Distinguished Paper Award.

“Since AIxCC, we’ve continued building on some of the core findings from our two-year journey with Team Atlanta,” Jiho Kim said.

“One of the biggest lessons for us was understanding how LLMs and traditional fuzzing can work together in a mutually beneficial way, using each to overcome the limitations of the other and ultimately find more and deeper vulnerabilities.”

The researchers also wanted to make the lessons from AIxCC useful to other cybersecurity researchers.

They created an Open-Source Cyber Reasoning System Framework (OSS-CRS) and CRSBench, which provides researchers and security professionals with ways to use, test, and build on technology developed through AIxCC.

“We’ve also been focused on making the results of AIxCC useful to the broader security community,” Kim said. “We created OSS-CRS and CRSBench so that researchers and practitioners can more easily use, reproduce, and build upon the capabilities and lessons from our AIxCC work.”

The team's research has also moved beyond identifying vulnerabilities. Researchers are studying how well AI models can understand and reason about computer code.

Jiho Kim and his lab mates in the Systems Software & Security Lab developed COIN, a benchmark designed to test how well LLMs can reason about code. The work has been accepted to the 2026 Conference on Empirical Methods in Natural Language Processing.

The Georgia Tech researchers are also developing additional benchmarks to study the various types of reasoning required for cybersecurity. They are using what they learn to create new datasets and methods for training AI models focused on cybersecurity.

“We’re using what we learn from these benchmarks to train cybersecurity-focused models through new datasets and training methodologies,” Jiho Kim said.

Photos by John Popham/College of Computing

News Contact