SafetyRisk, alignment & guardrails
Mike Walker, who ran DARPA's Cyber Grand Challenge, says AI models have upended the cost of cyberattacks
Mike Walker, who ran DARPA's 2016 Cyber Grand Challenge, argues that network security long depended on attacks being scarce and costly, and that AI models have overturned that cost. He says CGC-era expert-system tooling now serves as the harness around models.
From the Microsoft Research article of November 3, 2026 and cited sources: Walker argues that security across networked systems settled into a balance based on offensive scarcity, meaning high-end attacks had a known, high cost. [1] [2]
SOURCES[1] Learn the rules: The hacker mindset microsoft.com[2] Linked video: Learn the rules: The hacker mindset youtube.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- What happened
- Walker argues that security across networked systems settled into a balance based on offensive scarcity, meaning high-end attacks had a known, high cost. [1] [2]
- Original source
- Microsoft Research article, company source
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- Studies
- arXiv 2509.14589 (Sep 2025) [11] date from arXiv ID
- When
- November 3, 2026 article published
- Covered
- Nov 4 edition
- Evidence
- 11 sources across 8 sites
- 1Learn the rules: The hacker mindsetmicrosoft.com
- 2Linked video: Learn the rules: The hacker mindsetyoutube.com
- 3DARPA: Mayhem declared winner of Cyber Grand Challengedarpa.mil
- 4Microsoft Research: Introducing Project Fretamicrosoft.com
- 5DARPA: AI Cyber Challenge resultsdarpa.mil
- 6Infosecurity Magazine: AIxCC winnersinfosecurity-magazine.com
RisingHow it’s measured
YouTube video · 983 views · 13 likes
Reach blends public engagement (views, likes, comments, shares, stars) from the platforms where the story or its original source lives: YouTube, Hacker News, GitHub, Substack and similar. A video and the article written from its transcript share one score, taken from the video. Platforms with no data are left out rather than counted as zero, and the age of a story never lowers its score.
Walker argues that security across networked systems settled into a balance based on offensive scarcity, meaning high-end attacks had a known, high cost. He says model capabilities have overturned that cost. He presents this as his own view and offers no data to support it. [1] [2]
CGC was an expert-systems contest without critical machine learning, and ForAllSecure's Mayhem won it in 2016. Walker says that rule-based orchestration layer survives today as the harness around models. One example is MDASH, a Microsoft multi-agent pipeline built partly by former members of Team Atlanta, which won AIxCC in 2025. [2] [3] [5] [7] [8]
Microsoft reports that MDASH scored 88.45% on CyberGym's 1,507 tasks in May 2026. By August, other agents had reported scores above 90%. Georgia Tech says follow-on work from former Team Atlanta members reached 95.95%, but no technical report accompanies that figure. [7] [8] [9] [10]
Walker describes security capabilities as dual use: whether a tool is an encryption utility or ransomware depends on who holds the key. His team builds defensive tools on the assumption that attackers will target them. One example is Project Freta, which collects memory telemetry from cloud hardware rather than from software an intruder could remove or fake. [2] [4]
AIxCC finalists found 54 of 63 planted bugs and 18 real ones, at about $152 per task. Implication, if Walker is right: risk models built around rare, expensive attacks need revisiting, and defensive tools themselves need hardening.
Executive brief
The CGC director now says attacks have stopped being scarce. Mike Walker ran DARPA's Cyber Grand Challenge (CGC), the 2016 contest where machines hacked and defended each other. On the Microsoft Research Podcast he argues that network security used to rest on attacks being rare and expensive, and that AI models have "completely upended" that cost (23:22). He links CGC to today's work: CGC's rule-based "expert system" tooling now serves as the harness (the agent scaffolding) around models, as in MDASH. Former members of Team Atlanta, which won DARPA's AI Cyber Challenge (AIxCC), helped build MDASH at Microsoft (21:58). No independent news coverage of the episode itself turned up.
What changed and event timeline
Machines play capture-the-flag
Seven autonomous systems competed at the CGC final. ForAllSecure's Mayhem won the $2M top prize. Walker called it proof that "machine-speed, scalable cyber defense" is possible ().
Project Freta launches
Walker's New Security Ventures team at Microsoft Research released a free service that inspects memory snapshots of Linux VMs (virtual machines) for undetected malware ().
Team Atlanta wins AIxCC
The Georgia Tech, KAIST, Samsung and POSTECH team took the $4M first prize at DEF CON 33. Trail of Bits and Theori placed second and third (;).
Microsoft unveils MDASH
Microsoft described a pipeline of more than 100 agents and credited it with 16 CVEs in that month's Patch Tuesday, four of them Critical remote code execution flaws ().
Team Atlanta's afterlife
Georgia Tech reports that former members joined Microsoft's FORGE lab. It says their work led to a model, MAI-Cyber-1-Flash, and that the CyberGym score rose to 95.95% ().
Walker interview published
On the Microsoft Research Podcast, Walker covers CGC's 10th anniversary, offense and defense as dual-use skills, and Project Freta ().
Capabilities and access
- MDASH: runs in five stages: prepare, scan, validate, dedupe, prove. It is used internally and in a limited private preview (Microsoft).
- MAI-Cyber-1-Flash: named only in Georgia Tech's report. Access terms are unstated.
- It handles more than 4,000 Linux kernel versions and reads .vmrs, .lime, .core and .raw images (Microsoft Research).
Read the full section
- MDASH: runs in five stages: prepare, scan, validate, dedupe, prove. It mixes frontier and smaller distilled models, with a second state-of-the-art model as an independent check. It is used internally and in a limited private preview (Microsoft).
- MAI-Cyber-1-Flash: named only in Georgia Tech's report. Access terms are unstated.
- Project Freta: written in Rust. It handles more than 4,000 Linux kernel versions and reads .vmrs, .lime, .core and .raw images (Microsoft Research).
Technical analysis for researchers and developers
- Harness lineage: Walker says CGC was an expert-systems contest with no critical machine learning.
- Evaluation: CyberGym asks an agent to write a proof-of-concept input that triggers a known bug before the patch and not after it.
- Tamper-resistant telemetry: Freta gathers memory signals from cloud hardware rather than from software an intruder could remove or fake (29:51).
Read the full section
- Harness lineage: Walker says CGC was an expert-systems contest with no critical machine learning. He sees that orchestration layer surviving as today's model harness (20:43).
- Evaluation: CyberGym asks an agent to write a proof-of-concept input that triggers a known bug before the patch and not after it. Sanitizers check the result automatically (Berkeley RDI).
- Tamper-resistant telemetry: Freta gathers memory signals from cloud hardware rather than from software an intruder could remove or fake (29:51).
- Reproducibility: AIxCC finalists released their systems as open source (DARPA). Georgia Tech released OSS-CRS and CRSBench (Georgia Tech). MDASH is not public.
Claims and evidence
- MDASH scored 88.45% on CyberGym's 1,507 tasks. Microsoft reports this itself (Microsoft). It was the top published result in May.
- The 95.95% follow-on score is reported only in a university news story, with no technical report attached.
- AIxCC finalists found 54 of 63 planted bugs, patched 43, and found 18 real ones, at about $152 per task (DARPA).
Read the full section
- MDASH scored 88.45% on CyberGym's 1,507 tasks. Microsoft reports this itself (Microsoft). It was the top published result in May. By August, a Crypto Briefing report listed a Sangfor agent at 93.2% and three others above 90%.
- The 95.95% follow-on score is reported only in a university news story, with no technical report attached.
- AIxCC finalists found 54 of 63 planted bugs, patched 43, and found 18 real ones, at about $152 per task (DARPA).
- The "offensive scarcity" thesis is Walker's opinion. No data accompanies it (23:22).
Context and prior work
- Walker's path into the field: the post-9/11 hunt for security talent, years of DEF CON capture-the-flag, then DARPA asking whether machines could play the same game ("robot soccer") (14:27).
- Team Atlanta's winning system, ATLANTIS, is documented in an arXiv report.
- When CyberGym launched in mid-2025, agents succeeded on roughly 10–30% of tasks (Crypto Briefing).
Read the full section
- Walker's path into the field: the post-9/11 hunt for security talent, years of DEF CON capture-the-flag, then DARPA asking whether machines could play the same game ("robot soccer") (14:27).
- Team Atlanta's winning system, ATLANTIS, is documented in an arXiv report.
- When CyberGym launched in mid-2025, agents succeeded on roughly 10–30% of tasks (Crypto Briefing).
Limitations, safety and contested findings
- Dual use: Walker says security tools are neither offensive nor defensive in themselves. The same automation that helps defenders helps attackers.
- Recall figures are backward-looking: Microsoft says MDASH's 96% and 100% recall on past bugs do not predict future discovery rates.
- Contamination: the reviewed CyberGym material does not address whether test bugs overlap with model training data (Berkeley RDI).
Read the full section
- Dual use: Walker says security tools are neither offensive nor defensive in themselves. Whether a program counts as ransomware or encryption depends on "who holds the key" (25:08). The same automation that helps defenders helps attackers.
- Recall figures are backward-looking: Microsoft says MDASH's 96% and 100% recall on past bugs do not predict future discovery rates. It also says 82% of benchmark failures came from vague task descriptions (Microsoft).
- Contamination: the reviewed CyberGym material does not address whether test bugs overlap with model training data (Berkeley RDI).
Business and practitioner implications
- Budget for cheaper attacks: if Walker is right, pricing risk around rare, expensive high-end attacks no longer works.
- Treat security tooling as a target: Walker's team builds defensive tools on the assumption that attackers will go after them (27:50).
- Don't spend user trust carelessly: every security demand asks users for trust, and wasting it weakens the whole regime (07:25).
Read the full section
- Budget for cheaper attacks: if Walker is right, pricing risk around rare, expensive high-end attacks no longer works.
- Treat security tooling as a target: Walker's team builds defensive tools on the assumption that attackers will go after them (27:50).
- Don't spend user trust carelessly: every security demand asks users for trust, and wasting it weakens the whole regime (07:25).
- Coordination beats raw talent: from his CTF days, Walker found that well-coordinated teams beat collections of individual stars (41:08).
The source trail.
Sources (11)
Learn the rules: The hacker mindset
Article text retrieved; extracted text may omit tables or interactive elements. A transcript of the video linked from this page is supplied (linked video manual captions; https://www.youtube.com/watch?v=uuXijUuj4MA); automatic text may contain errors.
microsoft.comLinked video: Learn the rules: The hacker mindset
linked video manual captions
www.youtube.com