Frontier AI has broken the open CTF format

walletdrainer

>I started playing CTFs in 2021 >and the old game is not coming back For many people the CTF scene was already dead in 2021 because it had turned into something unrecognisable. In reality it’s just different.

deafpolygon

Unrelated, but does anyone find this site incredibly hard to read?

tromp

https://en.wikipedia.org/wiki/Capture_the_flag_(cybersecurit... still has no mention of AI, but that will likely change as they increasingly dominate competition.

vasco

My first ever was Stripe CTF in 2012 I think, I still wear the shirt I got (now super fainted) from passing some challenges. I was a student in portugal and remember receiving the shirt for it and thinking, maybe those Americans aren't any better than me and I can compete at the same level. I never got super into security but it gave me the confidence to play in the same field and lose the stupid aura I had that somehow "rich americans" would be better than me at everything because they had better universities or because of Hollywood or something. Sad that another cool thing is lost to AI but I guess kids will learn in other ways.

chvid

What is CTF? And why is the cyber security world filled with silly gaming references?

monarx

used to see some really good CTF videos show up on youtube and now nothing like that shows up on the feed

susam

I have normally found any sort of timed technical competition intimidating. Even so, about 6 or 7 years ago, after being persuaded by a colleague, I participated in a few CTFs. I am glad I did, back when this type of thing still meant something. I have kept a screenshot from one of the CTFs that I am quite fond of: https://susam.net/files/blog/ctf-2019.png

eecc

“solve”, why not solution? Like “spend” and not expenditure, why use the verb as a noun and not care about grammar?

kevinsimper

You could make it offline and with provided laptops only, just like with the competitive CS2 scene.

rurban

I don't do CTF's but took part at the security workshop for fun ~2 years with my Android phone only. I was first with the first simple challenge, but then couldnt continue because my phone was just too limited. But I watched what the others did. And a young Indian guy did everything with ChatGPT then. I found it silly, but amusing, because he actually got second. There was no Codex nor Claude then. Nowadays it must be dead for real, because I would solve everything with my agents, as I do in the real world.

Grimburger

Very impressed that OP has gone from starting university in 2021 to becoming a Senior Security Engineer. It's an incredibly exciting time in security research in my humble old man opinion. Think the cadence of new exploits is perhaps a good measure of that rather than subjective thoughts by anyone regardless of experience.

himata4113

I was writing an obfuscator recently, I just had the model deobfuscate and optimize the code back to original and I kept improving the obfuscator until it couldn't. The funny thing is that after all this I also ended up with a really strong deobfuscator and optimizer which is probably more capable than most commercial tools. The solution is just to make CTFs harder, but when do CTFs become too hard? Maybe the problem is that 'hard' CTFs are fundementally too 'simple' where it's just a logic chain and an exhaustive bruteforce towards a solution since there really are limited ways to express a solution in plain sight. Or maybe human creativity has been exhausted and we're not so limitless as we thought. Only time will tell. I had another idea spring to mind: we could hide two flags, one that could only be found by ai agents and not humans or tools written by humans.

amingilani

I don’t think CTFs are dead, they’ll just evolve. The difficulty level will need to be increased or the rules locked down. Just like sports and racing persist despite the existence of performance enhancing drugs and rocket technology. I just did a CTF where I was in the top 10. It was the first CTF I completed and I used AI because the rules permitted it. That said, I couldn’t solve all challenges. But yes, it was significantly easier now than I last attempted one. Even manually solving with AI assisted assembly interpretation was much easier.

raphman

Interesting and well written article that mirrors/foreshadows how LLMs do and will change other scenes. As I don't know much about the CTF scene, I looked for other takes on this topic. Here's an article from 2015 about how tool-assistance already changed CTFs: > Individual skill will undoubtedly be a factor next year. But, I'm left wondering whether next year's DEFCON CTF will tell us anything more than how well-developed each team's tools are (and how well they can interpret the results). https://fuzyll.com/2015/ctf-is-dead-long-live-ctf/ But there are quite a few recent (2026) articles with the same core message as in the original article, e.g., https://blog.includesecurity.com/2026/04/ctfs-in-the-ai-era/ or https://k3ng.xyz/blog/ctf-is-dead And here's someone explaining how Claude Max allowed them to win CTFs: > I had always been interested in CTF as one of the only ways people could compete and show off their skill in coding/problem solving on a global scale. It was just too difficult and didn't make sense for me to learn the fundamentals as an electrical engineer. As time went on, I got better and better, and it was hard to tell whether it was because of experience or if it was because of improvements in AI. > I accomplished my goals, and for that reason I'm quitting CTF, at least for now. [...] I'd like to think I highlighted the problem before it became a bigger issue. So, how do we fix this? Teams and challenge authors losing motivation is not good. CTF dying is not good. AI bad. Or is it? https://blog.krauq.com/post/ctf-is-dying-because-of-ai The only article that saw LLMs as a non-negative force for CTFs was this one. Fittingly, it sounds like LLM output ( "Let's be honest", "This is where things get interesting." ) and only contains hallucinated references. https://caverav.cl/posts/ctfs-not-dead/ctfs-not-dead/

utopiah

Right, the same way that car racing has "broken" jogging. This is so dumb. /s The whole point of competitions is to provide a safe environment thanks to a set of rules all participants AGREE on in order to progress together. If new tools "break" the competition, we change the rules and that's A-OK. CTF isn't a natural phenomenon, if tools change, rules change, simple.

rqd3

tldr; adapters took my elo

r4indeer

I'm conflicted on the use of AI in CTFs. On the one hand, they are supposed to mirror real-life scenarios, so of course you should be able to use any tool that would be available to you in real life. On the other hand, CTFs are fundamentally a game and a competition which are supposed to be fun and compare and improve ones skill. So when I let an LLM generate the entire solution for me, what's the point anymore? I did not learn anything. I did not work for that place on the leaderboard, I just copied the solution. And worst of all, I did not have any fun. It's boring. So how does using AI as a solver not feel like cheating?

baq

Replace ‘CTF’ with ‘high school’ or ‘university’ and you’ve described the total slow motion collapse of education; the only saving grace is that most of it requires in person presence. We’ve figured out the human replacement pipeline it seems, but we haven’t figured out the eduction part. LLMs can be wonderful teachers, but the temptation to just tell it ‘do it for me’ is almost impossible to resist.

SoylentOrange

Great article, well written, and good analogy to chess. I’ve been playing competitive chess most of my adult life and I think that the solution lies in how chess dealt with this problem: Explicit ELO measurements with some cheating detection. AI assistance wholly banned. As you climb the ELO ladder, detection gets more onerous. At top level during online events, anti cheating teams require the use of both monitoring software and multiple cameras. Idea is that you can cheat pretty easily at the lowest levels but it gets less easy the higher you go. This allows for better feeding into the truly elite competitions. I think chess’s very firm stance that AI is never allowed in competition (neither online nor in person), rather than CTF’s acceptance, was the right call.

3qw128

The article is the thickest of AI slop. Don't believe anything.