In computer security, Capture the Flag (CTF) is an exercise in which participants attempt to find text strings, called "flags", hidden in intentionally vulnerable programs, websites, devices, or other systems. CTFs are used for competitive and educational purposes. In the two most common formats, participants either solve stand-alone challenges provided by the organizers (jeopardy-style CTFs) or defend their own systems while attempting to steal flags from other participants (attack-defense CTFs). Mixed competitions combine elements of both formats.^[1] Competitions may be held online or in person, may include hardware and physical-security tasks, and may be designed for beginners or experienced participants. The name is derived from the outdoor game of the same name. CTFs are widely used to develop, practice, and assess cybersecurity skills in academic, professional, and recreational settings.^[2]

The first widely recognized cybersecurity CTF was held at DEF CON in 1996. Early DEF CON competitions used custom vulnerable services on a shared system and primarily tested offensive security skills; later attack-defense competitions required teams to protect their own services while attacking identical services operated by other teams.^[3][4]

The two most common formats are jeopardy and attack-defense.^[2] In a jeopardy CTF, teams solve independent challenges worth a fixed or dynamically adjusted number of points. Common categories include cryptography, digital forensics, web exploitation, binary exploitation, and reverse engineering.^[2][5] Solving a challenge reveals a flag that is submitted to a scoring system. In an attack-defense CTF, teams are given equivalent vulnerable services and must keep their own services available, patch vulnerabilities, and repeatedly exploit opposing teams to obtain flags.^[2] Mixed competitions combine jeopardy challenges with attack-defense targets.

CTFs can cover a broad range of technical skills, including software exploitation, password cracking, network analysis, programming, and incident response. A study of 15,963 published CTF solutions found that challenges emphasized technical topics, particularly cryptography and network security, while human-centered subjects such as social engineering and cybersecurity awareness were comparatively underrepresented.^[6]

CTFs are commonly used in cybersecurity education because they combine hands-on exercises with competition and gamification. Reviews of cybersecurity competitions have found that well-designed CTF activities can increase engagement and provide opportunities to practice technical problem-solving, although their educational value depends on factors such as challenge design, learner preparation, guidance, and feedback.^[7][8]

Educational CTF platforms target a range of audiences. PicoCTF, organized by Carnegie Mellon CyLab, was created to introduce middle- and high-school students to computer security.^[9] Pwn.college, maintained by a team at Arizona State University, provides free challenge-based material and supports parts of the university's cybersecurity curriculum.^[10]

CTF-style exercises have also been integrated into university courses.^[11][12] One documented example used jeopardy-style CTF assignments in an introductory information-security course at the National University of Singapore.^[13]

CTF and related cyber-range exercises are also used by military academies and government training programs. The National Security Agency's NSA Cyber Exercise is a year-round education and training program that culminates in a competition for students from United States service academies and military colleges.^[14]

Many organizers register competitions with the CTFtime platform, which maintains an event calendar, archives challenges and write-ups, and calculates seasonal ratings for teams and events.^[15][16]

The increasing ability of large language model-based systems to solve cybersecurity challenges has prompted debate over the future of capture-the-flag competitions, particularly the jeopardy format. AI agents can analyze challenge files, invoke security tools, generate and test exploits, retrieve flags, and produce written explanations with limited human involvement. In a 2026 study of 41 participants in a live, on-site CTF, competitors delegated increasingly large subtasks to an AI assistant as the event progressed; when four autonomous agents were separately evaluated on the same previously unreleased challenges, the best-performing agent placed second overall and outperformed most participating human teams.^[34]

Competitive teams have also developed specialized CTF-solving systems. Squid Proxy Lovers, one of the first to develop an agent, reported that its Squid Agent framework solved 46 of 50 challenges in the CTFTiny benchmark, while remaining less reliable on novel, large, or long-context challenges.^[35]

The adoption of these systems has raised questions about what conventional leaderboards measure. Participants may obtain flags or complete solutions without understanding the underlying vulnerability, and differences in access to models, computing resources, or inference budgets may influence results. Researchers studying AI-assisted cybersecurity competitions have proposed measures such as separate autonomy levels, traceable submissions containing agent logs or code, and scoring criteria designed for human & AI collaboration.^[36]

Competition organizers have responded through restrictions and disclosure requirements. The rules for the 2026 DEF CON CTF Qualifier prohibited fully or primarily autonomous teams but allowed human competitors to use large language model-based tools when humans remained meaningfully involved in directing the work.^[37] Teams classified their AI use as No AI, Low AI, or Human-Led AI, with those classifications displayed on the public scoreboard.^[37][38]

Alongside conventional jeopardy challenges, the qualifier included King of the Hill (KoTH) and LiveCTF challenges. These formats repeatedly evaluated submitted programs or strategies instead of awarding points only when a team retrieved a single static flag.^[39]

In July 2026, OtterSec, a blockchain security auditing company, announced the Save CTFs Fund, a US$100,000 initiative supporting experiments with competition formats intended to remain meaningful as AI capabilities increase.^[40][41] The company argued that conventional jeopardy scoring could increasingly reflect available inference budgets and advocated formats that compare the performance of exploits, defensive patches, bots, or strategies over multiple rounds.^[41]

OtterSec described the resulting community discussion as including declarations of the "death of CTFs".^[41] The debate more specifically concerns whether traditional human-focused jeopardy scoring remains an effective measure of cybersecurity skill. AI-use disclosures, restrictions on autonomous teams, and continuously evaluated formats indicate that some organizers are adapting CTFs rather than abandoning them.

• In Mr. Robot, a CTF tournament is depicted in the third-season premiere, "eps3.0_power-saver-mode.h". The technical advisers for the series said the scene was based on real-world CTF events and used a challenge adapted from a previous security competition.^[42]
• In The Undeclared War, a CTF is depicted in the opening scene as a recruitment exercise used by GCHQ.^[43]
• Go Go Squid!, a Chinese television series, centers partly on characters training for and competing in fictionalized international cybersecurity competitions.^[44]

• Wargame (hacking)
• Cyberwarfare preparedness
• Hackathon
• Competitive programming
• Cybersecurity in popular culture
• Privacy

• CTFtime – an archive and calendar of past, current, and upcoming CTF competitions.