Kabir Acharya, a competitor with TheHackersCrew and Blitzkrieg, published “The CTF Scene is Dead” on May 1, Groundy reported. His claim was narrow and testable: Claude Opus 4.5, run as an agent, now solves almost every medium-difficulty CTF challenge and some hard ones. He also reported that GPT-5.5 one-shots Insane-difficulty leakless heap pwn on HackTheBox, a claim that remains reported but not independently verified. The post went viral because the scoreboards had already caught up to the thesis.
What the 2026 scoreboards show
The sharpest data point is BSidesSF 2026. Sixteen teams fully solved every challenge, up from one in 2025, and no challenge drew fewer than 25 solves, Include Security reports. The top ten teams ran fully automated pipelines that solved most challenges minutes after release. A competitor who placed fifth solo in 2025 estimated they would have finished 75th this year without LLM assistance, according to Groundy’s reporting; the estimate originates with Include Security’s field report, whose author was that fifth-place solo competitor.
The winning team open-sourced its agent, and Include Security’s account describes the design: several different models race the same challenge in parallel, each with different strengths, while a coordinator LLM shares insights between agents and prompts any that get stuck with discoveries made by the others. GPT-5.4-mini quickly crushes the easiest challenges; Claude Opus 4.6 on max effort is slower but reasons deepest. When scores tie, solve speed decides, so the winning inputs are more agents, better agents, and faster hardware. In other words, more money.
The also-ran setups tell the same story. Include Security’s author built a Debian VM stocked with a conda environment, Playwright, Ghidra and a Ghidra MCP server, then pointed Claude Code on the $100-per-month Max 5x plan at each challenge directory, running Opus 4.6 at max effort with a dead-simple prompt. That cleared almost every challenge, the tough binary exploitation ones included, with a human tabbing between terminals to monitor progress and occasionally steer the model. It was nowhere near the top ten.
The architecture is the lesson, not the scoreline. Nothing here requires research breakthroughs; it is competent scripting run wide. Parallel model racing hides the variance of any single model behind whichever one happens to crack a given challenge first. Pre-loaded tooling removes the setup friction humans used to pay at the start of every challenge. Independent benchmarking points the same way: an arXiv analysis of agent harnesses surveys results showing that holding the model fixed and changing only the surrounding harness shifts a single model’s long-horizon task score by up to 18 points, with Claude Code among the harnesses tested. The scarce resource is no longer who can chain a ROP gadget. It is who has wired the harness, paid for the tokens, and tuned the hand-off between agents. That is an engineering moat, and engineering moats fall fast.
A separate onsite CTF study with 41 participants found that the strongest autonomous agent scored 4,900 points, second among the top-ten human teams, at an API cost of $96.32. Sixty-four percent of participants with low CTF expertise but high AI expertise reached intermediate-to-high scores. The API bill for out-placing most human teams at a live event came in under a hundred dollars.
Why medium challenges are the keystone
The reflex response to LLM-solved CTFs is “make harder challenges.” That works, for now, at the top of the difficulty ladder: AI cannot yet autonomously solve the majority of challenges at harder events like hxp and DEF CON, Include Security reports. But those events are the narrow apex of a pyramid whose base is medium-difficulty regional competitions, university CTFs, and training platforms like CTFd and HackTheBox.
The base of that pyramid is where the talent pipeline lives. It is where students first learn heap layout, first chain a ROP gadget, first realize JWT tokens are often just base64 with no signature check. Those challenges are solvable by design: they exist to teach. If they become trivially automatable, the pipeline stops filtering for skill and starts filtering for who can afford the better API key.
BSidesSF makes a point of publishing challenge source code and write-ups afterwards, which is exactly what makes it a good learning event. It is also what feeds the models. The same field report puts the mechanism plainly: a wealth of public write-ups means easier challenges are usually a minor variation on something already seen, and the categories holding up best, such as cryptanalysis of symmetric ciphers, are the ones with fewer write-ups in the wild. Every solution posted to GitHub makes the next model marginally better at that category.
The organizer’s trilemma
CTF organizers face three options. All of them are bad.
Ban AI assistance. Detection is the immediate problem. In a remote competition you cannot distinguish a competitor silently querying GPT-5.5 from one who is simply fast, and onsite proctoring fares little better: the 41-participant study above ran in person and AI-assisted participants still blended into the field, per Groundy’s reporting. Bans are unenforceable theater.
Redesign challenges. This raises authoring cost substantially. The traits that resist agents are multi-step reasoning chains, novelty that exceeds the training window, “guessy” tasks with little training data, or poorly documented software internals where the documentation contradicts the source code. The authoring expertise for that tier is scarce and expensive.
Accept it. Open scoreboards become leaderboards of agent budgets and harness engineering. CTFTime rankings lose calibration as a talent signal.
None of these resolve cleanly. The honest path for most regional and training competitions is probably a combination of ephemeral challenges (never published, never reused) and explicit AI-permitted divisions that treat tool use as a first-class skill rather than a cheat.
What still resists automation
AISI’s corporate-network scenario, “The Last Ones,” is a 32-step attack chain that AISI estimates would take a human expert roughly 20 hours. Its evaluation found that Claude Mythos Preview became the first model to solve it from start to finish, succeeding in 3 of 10 attempts and averaging 22 of 32 steps. Opus 4.6, the next-best performer, averaged 16 steps. A later Mythos Preview checkpoint pushed that to 6 of 10 on “The Last Ones” and became the first model to also clear the previously unsolved “Cooling Tower” OT range, in 3 of 10, making it the only system to complete both AISI cyber ranges; GPT-5.5 solved “The Last Ones” in 3 of 10 attempts. AISI notes that capability jumps do not always require new model releases, since a later checkpoint of the same model moved these numbers.
These runs are expensive in tokens and cheap in dollars. A serious range attempt consumed roughly 100 million tokens, about $80, already less than an hour of professional penetration-testing time.
Treat the range results with AISI’s own caveats. The ranges lack active defenders and defensive tooling, and there are no penalties for actions that would trip real alerts, so AISI cannot say whether the model would succeed against well-defended systems. The earlier Cooling Tower failures came from getting stuck in the IT phase, not from a genuine OT-layer wall, so the ICS resistance may be thinner than the raw pass rate suggests. And the step from a single flag to a professional engagement is wider still: Include Security’s comparison of CTFs against pentesting points to open-ended goal structure, false-positive management, scope discipline, and client reporting as the places where experienced practitioners still carry the work.
The pace is the part no snapshot captures. AISI’s doubling-rate estimate for 80%-reliability cyber capability compressed from 8 months to 4.7 months between its November 2025 and February 2026 estimates, and Mythos Preview and GPT-5.5 have since outperformed that trend. AISI cautions it is too early to call that a new, faster trend rather than an isolated break. Either way, a static snapshot understates capability by the time you read it.
The defensive side: Palo Alto’s Patch Wednesday
Palo Alto Networks’ May 2026 Patch Wednesday covered 26 CVEs (75 discrete issues), the first advisory cycle in which the majority of findings came from frontier AI models scanning more than 130 products, against a typical month of fewer than 5 CVEs. They tested Claude Mythos, Claude Opus 4.7, and GPT-5.5-Cyber through the Trusted Access for Cyber program and Project Glasswing. That testing predated Opus 4.8, which shipped May 28, 2026, and is around four times less likely than Opus 4.7 to let flaws in code it has written pass unremarked, according to Anthropic.
Two findings deserve attention. First, achieving high-fidelity vulnerability results requires scanning harnesses with context, guardrails, and threat intelligence integrated into the prompt pipeline; pointing a model at source code alone does not suffice. Second, a multimodel approach is necessary because different models find different vulnerability supersets due to training variance. No single model catches everything; the coverage comes from the ensemble.
The timing claim in that post needs its date attached. On May 13, Palo Alto estimated a narrow three-to-five-month window for organizations to outpace adversaries before AI-driven exploits start to become the norm, and said it expects the currently restricted capabilities to flow more broadly to other models. Counted from mid-May, the near end of that window passed in August and the far end closes in mid-October. The post itself noted that none of the 26 CVEs were being exploited in the wild at disclosure time; it cannot settle what has happened inside the window since. The direction, though, is consistent with the AISI doubling rate and the BSidesSF scoreboard data.
The vendor response on the other side of this is worth noting. Anthropic held its Mythos-class models back pending stronger cyber safeguards, then released Claude Fable 5 on June 9 as its most capable widely released model, in a tier above Opus, per Groundy’s reporting. Fable 5 ships with cybersecurity classifiers that block offensive cyber tasks and showed zero compliance across the 30 jailbreak techniques Anthropic tested, while the companion Claude Mythos 5 stays restricted to Project Glasswing partners and select biology researchers for defensive work. None of this restores the medium CTF tier, which cheaper permissive models already clear. But the top of the model ladder now refuses some of the work the scoreboards reward, and which models CTF harnesses converge on is becoming a policy question, not just a benchmark question.
The talent pipeline downstream
CTFtime rankings have served as a proxy for security skill for two decades. Recruiters at defense contractors, consulting firms, and tech companies use them to filter candidates. That proxy is now noisy in a specific direction: it overestimates the raw technical skill of recent high performers who had access to capable agents, and it underestimates candidates who competed without them. The erosion is climbing the difficulty ladder too. hxp’s cryptography challenges were reportedly autonomously solvable by December 2025, and at DEF CON in August 2025 two challenges fell with major LLM assistance even though the models were of little use on the rest, according to Include Security. Dynamic scoring still means the harder events are decided by the challenges that resist agents. That residue is what is left of the signal.
Write-ups are a better one. A write-up demonstrates that the competitor understood the challenge, can articulate the exploitation chain, and can generalize the technique. An agent-generated solve produces none of these. Hiring managers who previously screened by CTFtime percentile should consider screening by write-up quality instead.
What trainers and recruiters should do now
The Deep Blue analogy is instructive. Chess did not end when Kasparov lost; it bifurcated. Human-only competition continued. Engine-assisted analysis became standard training. The rating system adjusted. Security training is about to undergo the same split.
Concrete steps:
- Ephemeral challenges. Regional and training competitions should move to challenges that are never published and never reused. This raises authoring cost but preserves difficulty calibration against training-data absorption.
- Explicit divisions. AI-permitted and AI-prohibited divisions, with the understanding that enforcement of the latter is imperfect and relies on honor systems and community norms.
- Write-up-based evaluation. For recruitment, weight demonstrated understanding over scoreboard placement. A clear write-up of a medium challenge is more diagnostic than an unexplained full solve.
- Retrain on what agents cannot do. Multi-step attack planning, false-positive triage, scope discipline, physical-layer interaction, and novel technique development remain human-domain skills. Training curricula should shift weight toward these areas.
Join the discussion
Share a useful perspective or ask a question about this article.