This week at DEF CON in Las Vegas, dozens of teams' AI systems are competing to find and fix security vulnerabilities in real open source software, automatically. The prize money is in the millions, and the organizer is an agency of the US Department of Defense. That's DARPA, and if you've used the internet today, you're using something it paid for.
A reaction to Sputnik
The Soviet Union launched Sputnik in October 1957, and the United States realized it had been surprised technologically. In February 1958 the Eisenhower administration created the Advanced Research Projects Agency, ARPA, with one mission: never be surprised again, and do the surprising instead. The "Defense" was added to the name in 1972, which is why both names show up in its history.
DARPA has an unusual structure. It has no laboratories of its own. A few hundred people, mostly program managers on short terms of three to five years, each run a portfolio of bold projects, funding universities and companies to do the work. They're expected to take big risks and accept that many projects will fail. That model, small, fast, temporary and tolerant of failure, is the reason for its outsized record.
What it actually built
The internet's foundations. In the 1960s ARPA's Information Processing Techniques Office, under J.C.R. Licklider and later Bob Taylor, funded research on time-sharing and networked computing. ARPANET went live in 1969, connecting four universities. In the 1970s ARPA funded Vint Cerf and Bob Kahn's work on TCP/IP, and ARPANET switched to it on January 1, 1983, the internet's birthday as far as many engineers are concerned.
A popular myth says ARPANET was designed to survive a nuclear war. Paul Baran's earlier work at RAND on survivable networks did influence the packet-switching idea, but ARPANET's actual purpose was more mundane: letting researchers share scarce, expensive computers across the country.
Berkeley Unix's networking. DARPA funded the University of California, Berkeley, to add TCP/IP to Unix, and 4.2BSD in 1983 put the internet protocols into a widely used operating system, along with the sockets API that programs still use. I covered that in the history of Unix and Linux.
Self-driving cars. The DARPA Grand Challenge in 2004 offered a million dollars to any autonomous vehicle that could cross about 150 miles of desert. Nobody finished. The best got about seven miles. In 2005, five vehicles completed the course, and the 2007 Urban Challenge moved to city streets. The people from those teams went on to found or lead much of the autonomous vehicle industry.
The voice assistant in your phone. Siri grew out of SRI International's work on CALO, a DARPA-funded project on AI assistants that ran from 2003 to 2008.
Stealth aircraft, drones and much more: stealth's first demonstrator, Have Blue, the precursors of today's military drones, and early work on night vision, materials and microelectronics.
What it gets credit for but didn't build
GPS is often listed as a DARPA achievement. DARPA did fund Transit, the satellite navigation system that preceded it, but GPS itself was developed by the US Air Force and the Defense Department's joint program office from 1973. Credit DARPA with the groundwork, not the system.
The World Wide Web was invented at CERN in Europe. Mosaic, the browser that popularized it, came from the National Center for Supercomputing Applications, funded by the National Science Foundation.
Why it's at DEF CON
DARPA has a habit of using public competitions to jump-start fields. Its 2016 Cyber Grand Challenge pitted fully automated systems against each other in a capture-the-flag contest. This year's AI Cyber Challenge, run with ARPA-H, the health research agency modeled on DARPA, asks teams to build AI systems that find and patch vulnerabilities in open source software that critical infrastructure depends on: the kind of code where, as xz showed this spring, one overloaded maintainer stands between everyone and disaster. The semifinal runs this week, with the final planned for next year's DEF CON.
Copies around the world
DARPA's model has been widely imitated. The UK set up ARIA, the Advanced Research and Invention Agency, in 2023. Germany has SPRIND, its agency for disruptive innovation. Japan runs Moonshot research programs. Each tries to recreate the same mix of empowered program managers, short terms and tolerance for failure, with mixed results, because the hard part to copy is the culture, not the org chart.
The uncomfortable part
It's worth being honest that DARPA is a military agency, and much of what it funds is weapons and surveillance technology. The internet and the voice assistant were byproducts of a mission to keep the US military ahead. Plenty of technologists are uneasy about that, with reason.
But the open, shared technologies DARPA funded, TCP/IP above all, became global commons that no country or company controls. That's perhaps the strangest part of its legacy: a defense agency paid for the most open infrastructure the world has ever built.
Since then
Added October 2026. The AI Cyber Challenge final was held at DEF CON in August 2025. The winner was Team Atlanta, from Georgia Tech, Samsung Research, KAIST and POSTECH, and the finalists' systems were released as open source.