Computing History | Paris Las Vegas — Mayhem Won DARPA's Cyber Grand Challenge

On August 4, 2016, seven high-performance computers faced one another in the ballroom of the Paris Las Vegas Hotel and Conference Center. [DARPA’s official final-event program](https://www.youtube.com/watch?v=n0kn4mDXY6I) records the date and venue, while its [expanded highlights](https://www.youtube.com/watch?v=v5ghK6yUJv4) identify the winner: Mayhem, built by Pittsburgh-based ForAllSecure.

DARPA called the Cyber Grand Challenge the world’s first all-computer Capture the Flag tournament. With their human teams outside the contest network, the “Cyber Reasoning Systems” had to examine unfamiliar software, find flaws, submit evidence that a flaw could be triggered, produce repairs, and keep their own services working while competing for points.

This was not a free-ranging attack on the public internet. The machines operated inside a purpose-built, isolated arena, and the challenge tested whether parts of vulnerability research and defensive response could move at machine speed without sacrificing system availability.

The contest ran for 96 rounds. [WIRED’s report from the ballroom](https://www.wired.com/2016/08/security-bots-show-hacking-isnt-just-humans/) described how Mayhem balanced the value of a patch against the risk that taking a service offline would cost more points; even after the system stopped submitting new work for many rounds, its earlier defense and strategy were strong enough for it to finish first and receive the $2 million top prize.

The result was consequential but not a declaration that machines had replaced security researchers. Other systems found subtle flaws quickly, yet some repairs also damaged the services they were meant to protect, and [participants emphasized](https://www.wired.com/2016/08/will-humans-bots-rule-cybersecurity-answer-yes/) that human creativity still handled problems the automated tools could not.

Holding the final beside DEF CON 24 connected a government research program with the hacker community’s long-running competitive tradition. The milestone showed a practical path toward tools that could help defenders handle repetitive analysis and large volumes of software, while keeping expert judgment central.

Sources: DARPA’s official final-event program and expanded highlights; WIRED’s contemporaneous contest report and follow-up analysis. Photo: [“Paris Las Vegas Hotel and Casino”](https://commons.wikimedia.org/wiki/File:Paris_Las_Vegas_Hotel_and_Casino.jpg), Jbro1186, 22 April 2022, Wikimedia Commons, CC BY-SA 4.0.