Overview
The AI Fixathon vulnerability discovery edition brings teams together to build agents that identify weaknesses in participating organisations’ internet-facing systems and assess whether those attempts are detected by the organisations’ monitoring. The challenge is framed around a practical question: can an attacker get in from the internet, and does anyone notice? It is for teams with penetration-testing and bug-bounty experience, as well as organisations that want to examine their external exposure and detection capabilities.
The event is scheduled for 18–20 November 2026 in Porto, Portugal, with both in-person and virtual attendance listed. Teams build vulnerability discovery agents and test them against real participating organisations, under agreed rules of engagement. The page identifies Kat Fitzgerald, a staff security engineer with experience at Google, Apple, and Uber, as a special guest. Luisa Lima and Kat Fitzgerald are also named in connection with a pre-event discovery and threat-modeling session for challenge owners.
Challenge and outcomes
Testing begins from the internet, without credentials. Potential targets include VPN gateways, partner and customer portals, and older services that may have been left exposed. Each identified weak point is accompanied by a check that the organisation can rerun, both immediately and after remediation. Attempts are logged with timestamps so organisations can compare agent activity with what their monitoring recorded.
Participating organisations receive a ranked list of findings across their external entry points, combined from the teams’ work, and a detection-gap report describing what monitoring caught, missed, or lost in noise. They also get to see several discovery agents built and tested in their own environment, helping them assess which approaches hold up before making a purchasing decision. Challenge owners can shape the work and have the first right to adopt the winning build.
Format and schedule
One week before the event, teams receive the scope but not the organisation’s name. Less than 24 hours before testing, they learn which organisation they have been assigned. During hours 0–48, each team tests its assigned organisation within the agreed scope. Mentors assess how agents are built as well as what they discover, and flag designs that may not hold up. During hours 48–72, every agent runs against every organisation, testing whether it works beyond the setup for which it was built.
After testing, each organisation nominates teams it would continue working with. A jury selects one winner from all nominees. The winning team receives €10,000, although the jury may decide that no team has earned the prize. The submission is a vulnerability discovery agent, judged both on its construction and its findings.
Safety and participation
Teams are vetted before matching because they will test live systems. No testing begins until written rules of engagement define exact targets, testing windows, and an emergency-stop contact for each side. Denial-of-service activity and destructive changes are prohibited. Each organisation can designate off-limits systems, including operational technology or banking systems. The scope is external only; access available to insiders is excluded.
Organisations can submit a challenge, while engineers, designers, and AI builders can apply as fixers. The page also invites interested sponsors to get in touch.
