The CTF scene is dead
A seasoned CTF player boldly declares the capture-the-flag scene 'dead,' attributing its demise to the rapid advancement of AI models. The author, a former top-tier competitor, argues that LLMs have transformed CTFs from a test of human security skill into a contest of AI orchestration and resource allocation. This provocative take resonates with Hacker News's ongoing fascination with AI's disruptive power and its implications for skill development and competition.
The Lowdown
The author, an experienced CTF player who began in 2021 and competed with top international teams, asserts that the competitive Capture The Flag (CTF) scene, which once fueled their passion for security, is now effectively dead. This isn't due to dislike, but a fundamental change brought about by AI.
- AI's Early Impact: Initially, tools like GPT-4 began solving medium-difficulty CTF challenges with single prompts, though harder challenges remained largely untouched, and the time-saving wasn't seen as a critical issue.
- Claude Opus 4.5 and Orchestration: The release of Claude Opus 4.5, especially with its CLI integration, marked a turning point. Almost all medium and some hard challenges became agent-solvable, shifting the competition's focus to building orchestrators that deployed AI instances per challenge.
- GPT-5.5 Seals the Deal: Later models like GPT-5.5 and GPT-5.5 Pro are capable of solving 'Insane' difficulty challenges, making open CTFs 'pay-to-win' based on token expenditure rather than human skill. The scoreboard now reflects AI orchestration ability, not security expertise.
- Broken Learning Ladder: The claim that 'beginners are fine' is dismissed, as the visible competitive ladder is dominated by AI, forcing beginners towards using AI before developing fundamental instincts, which hinders active learning.
- Misguided Defenses: Arguments that 'CTF isn't dead' or that AI is useful for security research miss the point; the competitive format itself is compromised. The analogy to chess engines highlights that AI is meant for analysis, not direct competitive play.
- Organizer Struggles: CTF organizers are caught in a bind, unable to effectively counter LLM solutions without making challenges guessy, overengineered, or unpleasant for humans.
- The Aftermath: The CTFTime leaderboard is now unrecognizable, top teams are disengaging, and the fun and value derived from human problem-solving and skill development are gone. The community is losing its ladder from beginner curiosity to elite competition.
While the competitive format of open online CTFs may be lost, the author emphasizes the enduring value of the CTF community. They advocate for finding new avenues for connection, learning, and maintaining the competitive spirit through security-adjacent social events and learning platforms, rather than clinging to a format that no longer serves its original purpose.