TLDR Tech / InfoSec
CTFs in the AI Era
Laurence Tennant of Include Security recounts BSidesSF 2026, where 16 teams fully solved every CTF challenge (versus one team in 2025) because Claude Code, Codex, and similar agents now crack easy-to-medium challenges including binary exploitation within minutes, shifting the competition from solving skill to infrastructure spend. Top teams ran auto-scraping pipelines that spawn parallel agents the moment a challenge drops and auto-submit flags, with the winning team open-sourcing a coordinator-LLM architecture that runs GPT-5.4-mini, Claude Opus 4.6 max-effort, and others in parallel and shares discoveries between stuck agents. Automated CTF success doesn't translate cleanly to pentesting because real engagements lack the unambiguous flag, bounded codebase, and consequence-free environment that make CTFs an ideal LLM testbed, with false positive triage, scope discipline, and business context still requiring human judgment.
Read the full story