Even $60M of expert curation leaks unintended bugs

the full state space and the LLM will just keep returning the same one. This is also a problem in some of the public competitions. For example, we won something called the Cyber Grand Challenge from DARPA. It was the first challenge from DARPA to show that fully autonomous cyber is capable. 50% of the hand curated challenges had unknown vulnerabilities. This was DARPA spent $60 million designing a contest trying to come up with problems that were well defined and well scoped and they accidentally added additional bugs and 50% of those were ones that were actually exploited. So this idea that we're just going to create synthetic problems with one bug doesn't work. People have tried it, spent a lot of money, you always introduce new ones. Second problem is second example I'd show is the AIxCC. I designed the scoring algorithm for this. This is again a very large DARPA program that ran last year in DEF CON where 18 of the bugs found were unintended ones. And so the TLDR on here is you can't just say, "Well, we're going to hand curate an environment with just one vulnerability." Experts have tried, it doesn't work. You have to change the problem definition.