DARPA Taps Xint to Secure Military Messaging via Autonomous AI

The Defense Advanced Research Projects Agency (DARPA) has selected Xint to develop autonomous AI application security designed to protect messaging applications used across the Department of War. The initiative aims to safeguard sensitive communications against eavesdropping and external threats by utilising advanced artificial intelligence to identify, triage, and patch software vulnerabilities.

Xint, a company that emerged from Theori, was chosen following its performance in DARPA’s Artificial Intelligence Cyber Challenge (AIxCC), a two-year, $29.5 million competition. The technology is tasked with performing deep analyses of both internally developed messaging applications and open-source projects, such as Signal.

Autonomous Vulnerability Detection and Patching

The technology leverages frontier Large Language Model (LLM) models to examine source code and reverse-engineer compiled binaries. This allows the system to assess the entire attack surface of an application. For example, when analysing an Android-based messaging tool, the AI examines the application itself, the Linux kernel, and the various components of the Android ecosystem situated between the app and the kernel.

Once vulnerabilities are detected, the AI automatically triages them based on how easily an attacker could exploit them. The system is also capable of generating patches to remediate the identified flaws.

Andrew Wesie, CTO and co-founder at Xint, noted that messaging applications present unique risks. “Messaging and communications applications are unique in that an attacker needs read-only access to compromise the entire point of the app,” Wesie said. He added that third-party software development kits (SDKs) and libraries embedded within these apps can create hidden data risks, potentially exposing a user’s location or other personally identifiable information (PII) without the knowledge of the developer or the user.

Expanding to Commercial Software Supply Chains

While the primary mandate involves securing Department of War communications, Xint is developing a Software-as-a-Service (SaaS) solution for commercial customers. This service is designed to assess software supply chain risk by analysing compiled code running in various environments, including on-premises software, appliances, and network daemons.

Enterprises can use the service to scan their own code before release to ensure it is vulnerability-free, followed by regular scans to detect new risks introduced after deployment. However, Wesie noted that providing these services within a customer’s private data centre remains a work in progress, as current frontier models from providers like OpenAI and Anthropic cannot yet be automatically utilised in entirely air-gapped or local environments.

The partnership represents a strategic intersection of military requirement and commercial innovation, as DARPA seeks to maintain technological advantages while Xint scales its autonomous security capabilities for the broader market.