March 11th, 2024—Phoenix, AZ: Shellphish Support Syndicate today announced that they are one of seven winners of the $1 million prize in the DARPA Artificial Intelligence Cyber Challenge (AIxCC) Small Business Track Competition.

The prize money will support Shellphish, a joint team of the Shellphish Support Syndicate, and faculty and students at Arizona State University, UC Santa Barbara, and Purdue University, as they work toward the next event in the AIxCC. Together, they will build an open-source cyber reasoning system that leverages advanced AI techniques to automatically identify vulnerabilities in software and propose software patches that fix the underlying vulnerabilities.

“As the Shellphish team has people that are both hackers and academics, that we call hackademics, we are incredibly excited to win this prize and to compete in the DARPA AIxCC competition,” says Dr. Adam Doupé, CEO at Shellphish Support Syndicate and Director of the Center for Cybersecurity and Trusted Foundations at Arizona State University.

Shellphish competed in the DARPA Cyber Grand Challenge (CGC) in 2016, ultimately winning 3rd place and $750,000 in prize money with the world’s first open-source cyber reasoning system, the Mechanical Phish.

“The CGC advanced the state-of-the-art in what was possible, and we are excited to build on our prior success to build the future as part of AIxCC,” comments Dr. Giovanni Vigna, Professor at UC Santa Barbara and Founder of Shellphish.

Dr. Antonio Bianchi, Assistant Professor at Purdue University, adds, “Beyond the Mechanical Phish, the CGC allowed Shellphish to develop several open-source research contributions that live on today, including the angr binary analysis framework.

The next step in the AIxCC is the Semifinal Competition (ASC) in August 2024, where all registered teams (not only the Small Business Track) will compete, and the top seven will advance to the Final Competition (AFC) and receive an additional prize of $2 million each.

“As we prepare for the ASC, we are driving research forward in applying recent AI advances such as LLMs to the important problem of securing the open-source software that we rely on every day,” says Wil Gibbs, PhD student at Arizona State University and Shellphish’s Official Team Leader.

The AFC will be held in August 2025 at the DEF CON security conference, where the seven qualifying teams will compete for not only bragging rights, but also a portion of the $8.5 million of prize money reserved for the top three.

“Shellphish has always been about solving the hardest problems in computer security in new and creative ways. We’re ready to hack hard, learn a lot, break stuff, and—most of all—have fun doing it. Winning the AFC would be a nice bonus.” says Lukas Dresel, PhD student at UC Santa Barbara and Shellphish co-Captain.

To learn more, see our team blog post about our story and our team roster.

About Shellphish Support Syndicate: Shellphish Support Syndicate was created specifically to support the Shellphish team to compete in the AIxCC. Shellphish Support Syndicate will drive forward the open-source spirit of Shellphish in the cyber reasoning system that they will create for the AIxCC competition.