# ATLANTIS: AI-driven Threat Localization, Analysis, and Triage Intelligence System

**Authors:** Taesoo Kim, HyungSeok Han, Soyeon Park, Dae R. Jeong, Dohyeok Kim, Dongkwan Kim, Eunsoo Kim, Jiho Kim, Joshua Wang, Kangsu Kim, Sangwoo Ji, Woosun Song, Hanqing Zhao, Andrew Chin, Gyejin Lee, Kevin Stevens, Mansour Alharthi, Yizhuo Zhai, Cen Zhang, Joonun Jang  
**arXiv:** [2509.14589](https://arxiv.org/abs/2509.14589)  
**Date:** 2025-09-18  
**Summary page:** https://www.summarizepaper.com/en/paper/2509.14589v1/

## Key points

- Team Atlanta won the DARPA AI Cyber Challenge at DEF CON 33 with their cyber reasoning system, ATLANTIS
- ATLANTIS autonomously discovers and patches vulnerabilities in software at high speed and scale
- The system integrates large language models with advanced program analysis techniques like symbolic execution, directed fuzzing, and static analysis
- Developed collaboratively by researchers from Georgia Tech, Samsung Research, KAIST, and POSTECH
- ATLANTIS excels in scaling across diverse codebases while producing semantically correct patches
- Notable components include BULLSEYE for directed fuzzing and DEEPGENERATOR for deep learning model generation
- Infrastructure includes sinkpoint-aware fuzzing loops, ensemble techniques, distributed design elements, and comprehensive component overview
- ATLANTIS-Java extends capabilities with LibAFL-based Jazzer tools
- ExpKit module provides essential functionalities like Sink Finder, Path Finder, PoV Generator to enhance vulnerability detection and patch generation processes within ATLANTIS
- Multilang aspect introduces SymState for concolic execution purposes along with shared utilities & libraries like FUNCTION TRACER and CODE RETRIEVER
- Core components PRISM and MARTIAN agents play crucial roles in enhancing performance through innovative workflows

## Summary

In the Final Competition of DARPA's AI Cyber Challenge (AIxCC) at DEF CON 33 in August 2025, Team Atlanta emerged victorious with their cyber reasoning system, ATLANTIS. This system was designed to autonomously discover and patch vulnerabilities in software at the speed and scale demanded by modern technology. By integrating large language models (LLMs) with advanced program analysis techniques such as symbolic execution, directed fuzzing, and static analysis, ATLANTIS overcame existing limitations in automated vulnerability discovery and program repair. Developed collaboratively by researchers from Georgia Institute of Technology, Samsung Research, KAIST, and POSTECH, ATLANTIS tackled key challenges in cybersecurity. It successfully scaled across diverse codebases ranging from C to Java while maintaining high precision and broad coverage. The system excelled in producing semantically correct patches that preserved the intended behavior of the software. One notable component of ATLANTIS is BULLSEYE, a directed fuzzing tool that enhances vulnerability discovery. The system also includes infrastructure for sinkpoint-aware fuzzing loops, ensemble fuzzing techniques, sinkpoint identification and management strategies, distributed design elements, and a comprehensive component overview. ATLANTIS-Java further extends the capabilities of the system by incorporating LibAFL-based Jazzer tools for enhanced fuzzing capabilities. DEEPGENERATOR is utilized for generating deep learning models to improve sinkpoint-focused directed fuzzing efforts. Additionally, CodeQL-enhanced sink detection methods and static analysis techniques are employed for distance computation. The ExpKit module provides essential functionalities such as Sink Finder, Sink Manager, Path Finder, PoV Generator among others to enhance vulnerability detection and patch generation processes within ATLANTIS. Furthermore, the Multilang aspect of ATLANTIS introduces SymState for concolic execution purposes along with discussions on its implementation details. The Multilang-LLM-Agent (MLLA) component offers standalone functionality while shared utilities & libraries like FUNCTION TRACER and CODE RETRIEVER contribute to overall system efficiency. Lastly, core components like PRISM and MARTIAN agents play crucial roles in enhancing the performance of ATLANTIS through innovative workflows and key architectural concepts. The detailed architecture of these agents showcases how they interact within the broader framework of ATLANTIS to achieve optimal results in automated security practices.