AIxCC Final Competition (AFC)

Seven teams have advanced to the final competition, which is already underway! The final competition consists of three unscored exhibition rounds, followed by a fourth and final round, which will be scored. The competition winners will be announced at DEF CON 33 in August 2025.

Competitors’ CRSs will be scored according to a scoring algorithm that assigns points for the CRS’ ability to find and fix vulnerabilities, as well as analyze bug reports. The vulnerabilities fall into two categories:  

• • Introduced synthetic: The competition will intentionally introduce synthetic vulnerabilities into challenge project software, which will only be used during the competition and not pushed to the public code base. 
  • Real-world: Vulnerabilities could exist in the challenge project software that were not intentionally introduced as part of AIxCC.

Such vulnerabilities will be scoreable. If any zero-day vulnerabilities are found throughout the course of the competition, they will be responsibly disclosed.