Final Competition Procedures and Scoring Guide

Competitors’ CRSs will be scored according to a scoring algorithm that assigns points for the CRS’ ability to find and fix vulnerabilities, as well as analyze bug reports. The vulnerabilities fall into two categories:

• Introduced synthetic: The competition will intentionally introduce synthetic vulnerabilities into challenge project software, which will only be used during the competition and not pushed to the public code base.
• Real-world: Vulnerabilities could exist in the challenge project software that were not intentionally introduced as part of AIxCC.Such vulnerabilities will be scoreable. If any zero-day vulnerabilities are found throughout the course of the competition, they will be responsibly disclosed.

This AIxCC Final Competition Procedures and Scoring Guide describes the format, procedures, and scoring for the AIxCC Final Competition (AFC), which will take place over a series of rounds in 2025.