The White House taps OpenAI and Google to hack-proof America

At the Black Hat conference in Las Vegas, the White House didn’t show up to crack down on hackers. Instead, it showed up with a nearly $20 million bounty to recruit them.

The Biden-Harris Administration just launched the AI Cyber Challenge (AIxCC), a massive two-year competition led by DARPA. The goal is simple: unleash top-tier artificial intelligence to automatically identify and patch critical software flaws across power grids, transportation networks, and the public internet.

To make this happen, DARPA recruited an unprecedented roster of partners. Anthropic, Google, Microsoft, and OpenAI are all lending their expertise and granting competitors access to their most advanced AI models.

Big cash, big models, and a two-year showdown

DARPA is putting up nearly $20 million in total prizes for the competition. To ensure independent teams and smaller operations aren’t priced out by compute and resources, DARPA is setting aside $7 million specifically for small businesses.

The timeline is built around the cybersecurity calendar. Teams will first face off in a qualifying event in Spring 2024. From there, up to 20 top scorers will head to the semifinals at DEF CON 2024.

The top five teams from the semifinals will take home cash prizes and advance to the grand finale at DEF CON 2025, where the top three will secure the lion's share of the purse.

Critically, this isn’t just an academic exercise. The Linux Foundation’s Open Source Security Foundation (OpenSSF) is serving as a challenge advisor, tasked with taking the winning code and applying it immediately to secure vulnerable software in the wild.

This move comes on the heels of the White House securing voluntary commitments from seven major AI labs last month, alongside the first-ever public red-teaming of major LLMs happening at DEF CON 2023.

Why it matters

In cybersecurity, defenders have always suffered from an asymmetric disadvantage: they have to protect every surface, while an attacker only needs one crack.

If you build software or manage infrastructure, the prospect of scalable, automated vulnerability patching is huge. AIxCC basically tries to invert that defensive dynamic by automating the discovery and remediation of bugs before malicious actors can weaponize them.

We think this is one of the smartest policy moves the administration has made on tech so far. Rather than just drafting theoretical guidelines, DARPA is forcing the top AI labs to put their frontier systems into the hands of real-world security researchers with real skin in the game. Bringing in OpenSSF also solves the notorious pipeline problem by ensuring real deployment instead of shelfware.

The obvious tension, however, is dual-use capability. An AI capable of autonomously parsing complex codebases to find subtle vulnerabilities and generate flawless patches is functionally identical to an automated zero-day hunting engine. Proving this technology works on the defensive side may inevitably accelerate the timeline toward fully automated cyber weapons.