DARPA Picks Xint to Use AI on Military Messaging App Flaws

DARPA selects Xint to analyze Department of Defense communication software

According to a SecurityWeek report, the US Defense Advanced Research Projects Agency (DARPA) selected Xint on Sep 29, 2026 to research the use of autonomous AI application security technology to deeply analyze communication apps developed both internally and externally for the Department of Defense.

DARPA was established in 1958, following the Soviet Union’s launch of an artificial satellite. It has long partnered with private companies to develop frontier technologies. Past collaborations have produced the internet (ARPANET), GPS and Siri.

Technology covers source code and compiled binary analysis

According to the report, Xint originated from the startup Theori and was earlier selected as one of three winners in DARPA’s two year, roughly $29.5 million ‘AI Cyber Challenge’ (AIxCC).

DARPA has commissioned Xint to analyze source code, whether from internally developed projects or open source projects involved in communication apps such as Signal. Xint also uses a new service launched in Sep 2026 to analyze compiled binaries, assessing software supply chain risk in environments such as military agents, on premise software, devices and network daemons.

Co-founder says reading a messaging app can compromise the entire system

Andrew Wesie, chief technology officer and co-founder of Xint, told SecurityWeek that communication and messaging apps are unique in that an attacker only needs read access to compromise the entire application. Third party SDKs and libraries can create hidden data risks. Even minor data leaks can expose a user’s location or other personally identifiable information within sensitive communications, and neither users nor even developers themselves may be aware of it.

Wesie said Xint’s technology is essentially ‘a set of tools and workflows built around frontier models’. It uses the latest frontier large language models to comprehensively examine all source code involved in an application and, when necessary, reverse engineer binaries. For example, when analyzing an Android app, it examines the app itself, the Linux kernel, and other ecosystem components between the app and the kernel.

Technology also extended to commercial customers, but on premise deployment still pending

The report states that Xint’s technology can automatically classify vulnerabilities based on attacker accessibility and generate patches for vulnerabilities that could be exploited by attackers. The technology is also offered as a SaaS product to commercial customers for regular vulnerability scanning before and after software release.

Wesie said some enterprise customers want to run the entire system within their own data centers to prevent source code leakage, but this capability is still under development. The main reason is that the latest OpenAI and Anthropic models cannot yet be automatically used within customers’ data centers.