AI cyber defence

AI that finds and patches vulnerabilities before attackers do.

Facts

Lane: Security and geopolitics
Wave: 6 of 12 (build order, not a date)
Needs: 12 boxes all the way back through hard links
Unlocks: 4 boxes downstream through hard links
Leverage: 0.5 points · stands in the way of 2 of 53 stages · rank 18 of 57
Cluster: Compute governance and geopolitics

Evidence as of October 2026

In DARPA’s AI Cyber Challenge final, AI systems found 54 of 63 planted vulnerabilities, patched 43, and found 18 real ones, at about $152 per task.

01DARPA: AI Cyber Challenge results

Detail boxes 1

Restricted release of dangerous capabilities capability · Built today · helps, not required

Holding back a model with dangerous skills and giving it only to defenders.

Anthropic is withholding Claude Mythos Preview from general release and giving it to about 11 partners and more than 40 maintainers under Project Glasswing.

01TechInformed: Anthropic launches Project Glasswing

Around it

Needs · 2

Reasoning modelsstage · Built today
Tool use and code executioncapability · Built today

Unlocks · 2

Model weight securitycapability · Emerging
Software that maintains itselfstage · Speculative · helps, not required

Loops and off-ramps

Cyber offence and defencereinforcing loop
Capex pullbackoff-ramp · cut off
Taiwan chip disruptionoff-ramp · cut off
Power shortfalloff-ramp · cut off
Capability plateauoff-ramp · cut off
Training data ruled outoff-ramp · slowed

Openings researchers' judgement, October 2026 scouting

Startup room 57/100 · rank 17 of 124 Research room 36/100 · rank 99 of 124

Crowding5 Lab overlap5 Small-team fit4 Buyer today5 Research openness3

Depth: deep
Players: XBOW ($120m C, $1bn+); RunSybil ($40m); Horizon3 ($186m); Pentera; Anthropic Glasswing; OpenAI Aardvark; Google CodeMender
Wedge: Patch throughput, not discovery: validation, triage, dedup and patch-to-production pipelines for open-source maintainers, OT/ICS and critical infrastructure. startup