The Disruptive Impact of Large Language Models on Capture the Flag Competitions and the Path Toward Fair Play

Capture the Flag (CTF) competitions have long served as the primary training ground for cybersecurity professionals, fostering deep technical intuition through hands-on practice. However, the rise of Large Language Models (LLMs) and agentic systems has fundamentally altered this landscape. By automating the identification and exploitation of common vulnerabilities, LLMs have effectively dissolved the barrier to entry for many challenges, leading to a crisis of purpose within the community.

The research maps a clear divide between tasks that are now trivial for AI and those that remain human-centric. In cryptography, standard attacks (e.g., RSA structural weaknesses, padding-oracle attacks) are now reliably automated. Web exploitation is currently in a state of flux, where common bug classes are easily chained by agents, but bespoke business-logic flaws and state-dependent race conditions remain resistant. Binary exploitation, once thought to be protected by the opacity of machine code, has seen the fastest erosion as agentic systems have gained the ability to drive debuggers and iterate on payloads autonomously.

The authors argue that the community's heated debate over whether AI constitutes 'cheating' is a category error. The conflict stems from an underlying, unaddressed question: what is the competition for? If the goal is to identify the fastest path to a flag, AI is a legitimate tool. If the goal is to certify human skill and foster intellectual struggle, AI usage undermines the very purpose of the exercise. The authors propose a four-component safeguard framework—including tiered divisions, AI-resistant design, investigative telemetry, and a clear code of conduct—to help organizers align their competition rules with their stated educational or competitive objectives.