Team Shellphish Dives Deep into Cybersecurity

Beneath the surface of the second-floor lab in UC Santa Barbara’s Harold Frank Hall, a pod of sharp minds is moving toward a $4 million prize and the expansion of artificial intelligence (AI). Shellphish, UCSB’s elite hacking team, has plunged deep into a two-year competition, the Artificial Intelligence Cyber Challenge (AIxCC) sponsored by the Defense Advanced Research Projects Agency (DARPA). 

Shellphish is one of seven teams competing this August. Each team will develop a program, which will be tested for its ability to detect and fix, without human intervention, code vulnerabilities in open-source software. These complex programs fuel everything from health care and financial networks to aerospace and public utilities.

Though their name suggests something small and edible, this crew’s net is wide, with 20 to 25 team members spanning across three universities: UCSB, Arizona State University, and Purdue. And, it turns out, the professors advising the teams in Arizona and Indiana are former UCSB students.

Last August, the team placed in the semifinals, earning them a $2 million prize that they use to support students, paying their tuition, and the team’s research. AIxCC takes place as part of DEF CON, a major hacking competition that Shellphish also competes in, which coincides with AIxCC in Las Vegas.

At UCSB, the team consists of a globally diverse group of individuals, with students ranging from undergraduates to PhD candidates and coming from countries all over the world, such as Germany, China, Italy, and Sri Lanka. ​​The students are developing an autonomous program called Artiphishell, and by June 24, they must complete their final code. By August 2025, Artiphishell and the six other teams’ programs will analyze the same real-world software for vulnerabilities. If Artiphishell identifies and patches the most issues, the team will win the $4 million first prize, which will be used to support their lab and team members.

For Shellphish, a lot of hours have been spent to get the team to where they are now. Giovanni Vigna, founder of Shellphish and distinguished professor at UCSB, has been leading the “hackademics” for more than a decade. Vigna joked that balancing life with the intense workload can be a challenge, but the team still manages to find moments of fun. Tianle Yu, an undergraduate at UCSB and team member, recalled those small but meaningful breaks during a hackathon in Seattle — swimming in a nearby lake or relaxing in the hot tub.

Although the thrill of competition drives the team, at its core, it’s a tight-knit, welcoming group fueled by collaboration and research, an ethos that sets Shellphish apart from its competitors.

Vigna noted that four out of the seven AIxCC finalists are university teams as proof that academic institutions remain a hub for cutting-edge innovation. “Our mission is not making money,” Vigna said. “It’s to do something new, and so we can take that risk.”

Unlike their corporate competitors, who must weigh every project against potential profit or loss, university teams like Shellphish have the freedom to take risks in the name of progress. “Big corporations usually don’t take huge risks. And this is a risk. This could not work. We worked for two years, 25 people. That would destroy a company, a startup,” Vigna said. “If you have a startup with 25 people working on something for two years and it doesn’t work, it’s a tragedy. For a university, it’s research. We do a lot of stuff that doesn’t work. That’s why it’s called research.”

Vigna and Lukas Dresel, a PhD candidate at UCSB and team leader, explained that the U.S. is at the forefront of AI and cybersecurity, and if it aims to remain in this place, there is a need for investments, specifically university-based. Dresel noted that they are at an interesting stage because no one has built a system like this before, so they are constructing the first iteration of what could be used to make everyone’s software more secure. Through AIxCC, DARPA is investing in further pushing the boundaries and capabilities of AI.

While Shellphish and Artiphishell head upstream in hopes of building a winning system, bragging rights and the prize are just a bonus: This team simply enjoys what they’re doing; it’s fun and a meaningful experience at this stage in their lives.

“It’s not a lab you can’t wait to get away from, maybe you want to stay too long. It’s fun, filled with research, and that’s what keeps people together,” Vigna said.