The Defense Advanced Research Projects Agency (DARPA) has selected Xint, a company that grew out of security firm Theori, to use AI to find and fix vulnerabilities in messaging apps used by the U.S. military, SecurityWeek reported Tuesday. The selection follows Xint's showing as one of three winners in DARPA's AI Cyber Challenge.

What Happened

Xint was chosen on the strength of its performance in the AI Cyber Challenge (AIxCC), a two-year competition with $29.5 million at stake that asked teams to build systems able to find and repair software flaws autonomously. SecurityWeek's report did not give a value or timeline for the new work.

The focus is messaging and communications software used by the Department of War, including apps such as Signal. Xint's system analyzes both source code and compiled binaries so it can assess a whole attack surface rather than a single codebase. For Android messaging apps, that means examining the app itself, the underlying Linux kernel and the surrounding components the app depends on. The tool then ranks flaws by whether an attacker can actually reach them and generates patches.

RelatedCISA Orders Agencies to Fix Exploited Palo Alto Firewall and Cisco Email Gateway Flaws by Saturday

Andrew Wesie, Xint's chief technology officer, described the product as a "harness and a workflow" built around frontier large language models, rather than a model of its own. He said messaging apps differ from most software because an attacker does not need to take control of them: simply being able to read messages defeats their purpose. He also pointed to third-party SDKs and libraries embedded in apps, which can leak data such as a user's location or other personal details even when the leak itself looks minor.

Why It Matters

The selection is an example of DARPA moving AIxCC technology from a competition setting into operational defense work. AIxCC was built around open-source software; applying the same approach to deployed communications apps, including their dependencies and the operating system beneath them, is a harder and more consequential test.

Messaging security has a specific resonance for the Pentagon. Secure communications tools are only as trustworthy as every component they bundle, and analysis that reaches into kernels and closed-source binaries addresses parts of the stack that app developers do not control. Automated triage also matters at this scale, since a system that reports every theoretical flaw would overwhelm the teams responsible for fixing them.

Commercial Track

Xint also sells its vulnerability detection as a software-as-a-service product. Wesie said the company is currently working with customers that have written their own code, such as web applications, and developers can use the service to scan code before release as well as for ongoing assessments. That gives Xint a commercial market alongside the defense work, and a route for techniques developed for military apps to reach enterprise software.

What to Watch

Details still to emerge include the size and duration of the DARPA engagement, which apps beyond Signal are in scope, and whether fixes Xint finds in open-source components such as Signal or the Linux kernel are reported upstream to benefit civilian users. The selection also raises the question of whether the other AIxCC winners receive similar follow-on work.