A Post-AI CTF Format Could Be A Research RetreatJESSICA RUAN<br>A Post-AI CTF Format Could Be A Research Retreat<br>August 11, 2026<br>The state of DEF CON CTF 2026 has left people in quite the mix of bittersweet doom and gloom. AI has killed CTFs for good! Farewell!! I know that we are young and I know that you may love me but I just can't be with you like this anymore, Alejandro~~ 🥀

I've been retired for quite some time since I started 8 (9?) years ago, but the community has given me so much in friends and mentors, and I would love for someone starting out in 2026 to still find that in the scene. I would hate to see it die out as some AI benchmark, and figured I'd sketch out a (really rough) form of it that might survive post-AI.

Here are some of the less-doomer yet pretty telling tweets from this year's finals:

Explaining the joke (which kills said joke, but here we are)

For readers outside of the AI coding scene, Codex and Claude Code are agentic coding harnesses, where you pretty much describe your goals to the agent in plain English, and it can read/write/execute code and iterate on it, largely without supervision.

Teams now point these AI agents at CTF challenges and let them grind it out, and the agents get most of the way there on their own.

And this Tibo guy works on Codex. Hence thank you Tibo, the true carry.

And, for readers outside of the CTF scene: CTFs, also known as Capture the Flag competitions, are a type of cybersecurity event where players "capture" pieces of texts known as flags from challenges that are meant to teach some idea in offensive/defensive security in some way. This often inspires the same players to become challenge authors and CTF organizers themselves, resulting in the CTF scene we see today.

exampleCTF{ex4mpl3_Fl46_p4yl0aD}

An example of a flag. The namespace exampleCTF identifies the competition that the flag comes from, while the payload ex4mpl3_Fl46_p4yl0aD uniquely identifies which challenge this flag is the answer text for.

The main reason people do CTFs is for their educational value, and the secondary reason is the friendly competitive spirit (bragging rights, money, a cool flight).

However, with AI in the picture, CTFs in their current form are no longer as good a measure of problem-solving ability. Teams are incentivized to throw as many AI agents at the problem as possible without slowing down and taking the time to understand what the challenge is really asking for, or else other teams will "solve" the challenge first.

Before you know it, you walk out without much knowledge/memory of what the challenges were about aside from the fact that you prompted a bunch of agents to go speedy badeedy and thinky thinky think very hard.

This is rather dismal, and it defeats the purpose for which most people do CTFs. Educational value? Well, not when you finish a competition without really knowing what the challenge was. Friendly competitive spirit? It's less fun when the thing being measured is whose agent harness is beefier and whose API budget is bigger...

It's also deflating for the challenge authors, when they can no longer swap stories with players on how they solved the challenge and what alternate solutions they found, if everyone's just proxying for their agents.

(ง •_•)ง Get Your Butts Up Off The Ground

Anyway, enough doomerism! I'm here to talk about a post-AI CTF format that I think could still deliver on both of those things. There will be enough learning and competitive spirit to go around.

Post-AI Format

TL;DR: We make the CTF more like real-world research.

Enter our post-AI CTF, which we oh-so-descriptively call Research CTF. Unlike pre-AI CTF, our post-AI CTF will have a very small, hand-curated set of challenges, a dozen at most, and it will take place over a longer stretch of time, at least a couple of weeks.

As the player, you don't have to solve every challenge to win. Rather, you just need to have made a meaningful "contribution" that outlives the event. You "win" if people use it or remember it warmly in some way.

Post-AI Challenges

The challenge author should start from a "thesis" of sorts. They should be able to explain clearly, in one sentence, what it is that they're trying to teach the player. For example,

"The purpose of my challenge is to teach the player how foos are secured via baz and how these bazzes can be bypassed, and this matters because foobarbaz."

where foo is something like sandboxes, or, idk, something exotic like autonomous vehicles.

The author should keep this "thesis" in mind as they design the challenges.

Then the author prepares two things:

First, the author prepares a few primer challenges that are given to the player in the first stage of the CTF. This is in standard Jeopardy format, where the challenges have flags planted, and the player's objective is to capture the flags. The player is allowed to use AI to solve these challenges, and they can use AI as much as they want.

Second, the author prepares a...