Xint DARPA AI Security Tool Exposes Critical Signal Flaws

Xint, an AI security startup selected by DARPA, identified three critical vulnerabilities in Signal's Android app during a single one-hour scan. The uncaught-exception bugs caused the app to crash and were responsibly disclosed and patched in Signal's version 8.11 release. Xint was chosen for this work following its performance as one of three winners in DARPA's two-year, $29.5 million Artificial Intelligence Cyber Challenge (AIxCC).

How Xint Works

Xint combines source code analysis, binary reverse engineering, and runtime inspection across the full software stack. For an Android messaging app, this means examining the application itself, the Linux kernel, and every component of the Android ecosystem in between. The goal is to detect vulnerabilities invisible to traditional tools that often focus only on encryption, leaving surrounding code, network components, and operating system layers under-scrutinized.

The technology automatically triages vulnerabilities based on their accessibility to an attacker and can generate patches for exploitable flaws. In September 2026, Xint launched a new service to assess software supply chain risk across compiled binaries running in diverse environments, from on-premises software and network daemons to other backend services.

The DARPA Partnership

DARPA selected Xint.io to research autonomous AI application security for deep analyses of messaging applications used throughout the Department of War. The announcement was made on September 29, 2026, in Austin, Texas. This partnership, partly funded by DARPA, aims to secure military communications against external eavesdropping by analyzing in-house, open-source, and proprietary applications at scale.

DARPA has a history of fostering groundbreaking technology through private industry partnerships, leading to developments like the internet, GPS, and Siri. The agency gains a tool to secure War Department communications, while Xint receives a major commercial opportunity and funding to develop additional capabilities.

Broader Impact and Use

Beyond the military contract, Xint retains its technology for commercial application as a Software-as-a-Service (SaaS) solution. The company is already engaging with customers who have written their own code, such as web apps, offering to scan code pre-release and conduct regular post-release scans. Some enterprises are deploying Xint on-premises to ensure source code never leaves their data centers.

Xint's parent company, Theori, has over a decade of experience securing code for commercial and governmental organizations. CEO and co-founder Brian Pak leads the firm. Through a public interest initiative called Project Canopy, Xint and Theori disseminate AI-powered preemptive defense capabilities to under-resourced organizations, including open-source software projects and major companies across Asia and Europe.

Context and Vision

Andrew Wesie, CTO and co-founder at Xint, explains the unique threat model. "Messaging and communications applications are unique in that an attacker needs read-only access to compromise the entire point of the app," he said. Third-party SDKs and libraries can create hidden data risks, exposing a user's location or personally identifiable information during sensitive communications without the user's or developer's knowledge.

Wesie describes Xint's system as a harness and workflow built around frontier large language models (LLMs) to automate deep security analysis. He emphasizes that independent attestation is critical for securing these applications. However, a current limitation is that Xint cannot automatically use the latest models from OpenAI or Anthropic while keeping all operations within a customer's own data center.

Xint continues to develop additional capabilities under its DARPA partnership, with plans to expand its AI-powered preemptive defense via Project Canopy to under-resourced organizations globally.