Why I Am Against AI Usage in CTFs

First of all, I believe CTFs are, at their core, about learning and problem-solving. They present you with a variety of challenges that you are expected to solve yourself, awarding points for each one and ranking players based on how many challenges they manage to solve.

Over the last few years, AI usage has skyrocketed in pentesting, and naturally, it has also made its way into CTFs. Nowadays, we can see challenges being solved in seconds and scoreboards reaching extremely high scores only a few minutes into a competition.

To me, this misses the point.

CTFs are supposed to be an opportunity to learn from challenges and, in a competitive environment, to test your own problem-solving skills. Even if you disagree with the idea that CTFs should primarily be about learning, I think it is reasonable to expect a CTF competition to measure the skills of the person competing, not how much they are willing to pay for the latest AI model, or how effectively they can prompt it to solve a challenge for them.

Chess is the comparison that usually comes to mind when I think about this topic. AI is obviously extremely useful for learning chess, and tools like Stockfish have become an essential part of how many players study and improve. However, you do not see chess tournaments where players are allowed to use Stockfish during the game while they sit behind the board and make the final moves themselves.

The reason is simple: the tournament is supposed to test the player’s own ability to think and make decisions, not their ability to use an external tool to find the best move.

I think CTFs should be treated similarly. AI can be an incredible tool for learning, practicing, and improving outside of competitions. But when it comes to an actual CTF tournament, I believe the challenges should test the competitor, not the model they have access to or how well they can prompt it.

Otherwise, we risk turning CTFs from a competition of problem-solving skills into a competition of who has the best AI workflow.