AI Is Solving CTF Challenges in Minutes

henrydark

Not this one: https://drorspei.com/whatsmynumber

BarryMilo

Reads like AI writing again. Can you just post the prompt?

ComputerPerson

How are people getting models to CTF when I can't even simulate a reverse engineering attempt on an open source project? I'm glad I can't, but I'd like to be informed. Is it prompt engineering or just some model/harness combination?

simonw

This is slightly old news at this point - the BSides conference was in March, this article was published in May, we've had a whole lot of additional evidence since May that makes it unsurprising that AI can solve CTF challenges! Here's the repo mentioned in the story: https://github.com/verialabs/ctf-agent > Autonomous CTF solver that races multiple AI models in parallel. 1st place BSidesSF 2026. That one hasn't had any commits since March 28th. Looks like it was running Claude Opus 4.6 and GPT-5.4. I expect Opus 5 and GPT-5.6-Sol would be even more effective. (Fable 5 would refuse the challenge, Mythos 5 would undoubtedly nail it.)

piazz

> The implications are clear: focus on the human-skills part of the job. The implications are not clear. They are not clear for the security people, for the SWE people, for anybody in knowledge work whose jobs are impacted. I wish people would stop with the “the solution is merely simply retool against the part the AI isn’t good at yet ” cope and feel the enormity of the moment with humility. When the dust settles these jobs may not exist, or the jobs that do exist will be unrecognizable from the ones today and perhaps so qualitatively different as to no longer be attractive.

bmenrigh

I'm one of the BSidesSF CTF organizers and challenge authors (symmetric). The article is a few months old now (May) which is ancient history as far as AI advancements go. That said, I'm still emotionally coming to terms with what happened. Speaking from my own perspective (and not any of my challenge co-authors), I felt completely blindsided by the incredible progress frontier models made in solving CTF challenges between 2025 and 2026. We've been running the BSidesSF CTF for more than 10 years now, gaining experience on what makes a good, fun, and fair (solvable without random guessing) CTF challenge. 2026 was the first year where all of our past experience didn't seem to apply. Challenges that I designed to be hard, that I expected to take a dedicated human 10-20 hours to solve, fell to LLM automation in minutes. I don't know what the future of CTFs is going to be, but I wouldn't be surprised if they're largely dead in 1-2 years. A lot of the satisfaction I get from making challenges is in seeing players struggle, learn, and then eventually solve them. I'm not sure there are going to be many players willing to sink 20 human hours of their weekend into one challenge when a dozen teams using AI solved the challenge in under an hour. Overall I'm thrilled with the capabilities we're getting with AI, but saddened by what we're losing. I hope CTFs can somehow hold on, and that I can still get a lot of satisfaction out of building challenges and having players solve them.

elmer2

The OSCP limits tooling during the exam, even though things like Metasploit have existed for a decade. Companies using this for a tech interview will just need to have a proctored CTF exam, to ensure no cheating with AI. Bsides could split between human only and AI CTF challenges. These solutions aren't hard.