David Brumley

Sources: ExploitBench (arXiv 2605.14153)

What / Who

Carnegie Mellon University professor and founder of ForAllSecure, maker of the Mayhem autonomous analysis system. Brumley’s team won DARPA’s 2016 Cyber Grand Challenge — the first machine-vs-machine autonomous capture-the-flag, where systems found and patched binary vulnerabilities without human intervention. With Seunghyun Lee he co-authored ExploitBench (2026), the capability-ladder benchmark for LLM exploit development.

Relevance to This Wiki

Brumley connects the symbolic-execution / fuzzing era of autonomous exploitation (Mayhem, DARPA CGC) to the LLM-agent era (ExploitBench). ExploitBench’s framing — exploitation as a measurable ladder from coverage to arbitrary code execution — carries the rigor of the CGC scoring model into frontier-model evaluation. His work grounds the frontier-AI-for-vuln-discovery thesis in a decade of prior autonomous-exploitation research.