Table of contents
19
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member)
Read this in 30 seconds: A Claude Code CTF setup can solve many practice challenges, but whether you are allowed to use it in an event depends on that event’s own rules, and the rules differ more than most players expect. I read the event rules, the research and the tooling documentation on 10 November 2026 and put them in one place.
- Event rules decide first, and they vary wildly. Hack The Box gives each event admin three settings (Disabled by default, Enabled, or MCP Only), its Holmes 2026 CTF bans AI as a primary solver, and LakeCTF bans generative AI “of any form”, including agentic workflows.
- Claude Code CTF requests may be routed to an older model. Anthropic’s model documentation says Capture the Flag exercises trigger model fallback frequently, often on the first request, and calls it expected routing and not an account flag.
- Agents are strong at Claude Code CTF work but not unbeatable. A February 2026 study put four autonomous agents on a live university CTF and they placed second overall, and the best configuration reached 4,900 points for roughly $95 to $96 in API usage, yet Hack The Box reported that its best human team still out-solved its best AI team.
- The setup is mostly skills and a brief. The ctf-skills repository (MIT licence, about 3,700 stars, 12 skills) gives Claude Code per-category playbooks, and a short challenge brief plus a flag-check script does the rest.
- XHack runs the same Claude Code CTF work in one chat. It combines an autonomous agent with verified-access unrestricted capability, from $20 a month with a 7-day trial, and the practice-lab rules below apply to it too.
If you searched for Claude Code CTF, you probably want to know whether to point a coding agent at a challenge and what happens when you do. The short answer is that it works on practice challenges and in events that allow it, and that the rules matter more than the setup.
This Claude Code CTF guide covers the rules first, then what Claude Code can do on a challenge, the setup I would use, the refusal behaviour you will hit, and a way to practise without outsourcing your learning. I did not run a timed benchmark, so every number below is from a source I name.
Whether a Claude Code CTF workflow is allowed is an event-by-event question, and the answers I found range from “required” to “banned”. Read the rules page of each event before you open a terminal, because organisers can revoke solves and ban teams.
| Event or platform | AI rule I read | What it means for a Claude Code CTF run |
|---|---|---|
| Hack The Box CTF platform | Admins pick Disabled (the default, AI not permitted), Enabled (optional) or MCP Only | Check the event’s setting; the default is off |
| Holmes CTF 2026 | AI is allowed as a supporting tool, but using it as a primary solver is prohibited | Use it to think, not to solve |
| Global Cyber Skills Benchmark 2026 | Hybrid mode allows AI as a co-pilot with human-led problem solving; fully or semi-autonomous solves and unattended model execution are excluded | An autonomous agent loop is out |
| LakeCTF (EPFL) | No generative AI of any form, including agentic workflows | Do not use it, even though the policy rests on trust |
| Fluid Attacks CTF | Two scoreboards, AI-Prohibited and AI-Permitted, chosen at registration | Pick the AI-Permitted board if you use it |
Three details show how seriously organisers take Claude Code CTF use. LakeCTF says it cannot enforce its ban absolutely and asks players for trust. Fluid Attacks puts its largest prizes on the AI-Prohibited board ($1,800, $900 and $500 for the top three, against $400, $300 and $100 on the AI-Permitted board) and interviews the top AI-Prohibited finishers on camera before paying out. Hack The Box says it may ask for a walkthrough of your reasoning, that solves may be revoked, and that it reviews teams for over-automated behaviour.
I could not read the rules of every event, and I found no current picoCTF or DEF CON AI policy, so check those directly. The simple rule is that if an event’s page does not say AI is allowed, ask the organisers before you use it.
Claude Code is good at the repetitive, tool-driven parts of a challenge, and the best public evidence says humans with agents beat either alone. Here is what the studies and reports show.
| Source | What it found | Limits |
|---|---|---|
| Tang et al., arXiv, Feb 2026 | On a live university CTF with 41 studied participants, four autonomous agents with Claude-family models placed second overall; the best configuration reached 4,900 points for roughly $95 to $96 in API usage | Claude-family models from early 2026 or before, not today’s; one event |
| Help Net Security on Hack The Box data, Aug 2026 | In the NeuroGrid CTF, AI-augmented teams solved at 3.2 times the rate overall but only 1.69 times among the top 5%; the team that finished all 36 challenges was human and the best AI team stopped at 32 | Hack The Box’s own data; the board design changed |
| Hack The Box blog, May 2026 | At a UK financial services hackathon, the top two teams solved 74 of 76 challenges, and the winner was two people running several AI agents under human direction | One event |
The study’s quote on cost is worth pausing on: the paper’s text gives the best configuration’s cost as $96.32 in one place and the summary I cross-checked gives $95.32, so I say roughly $95 to $96. The same paper found that people with low CTF expertise but high AI expertise often scored competitively, and that most people with neither expertise completed one challenge or fewer. So the skill that pays in Claude Code CTF work is not “knows the tool”, it is “knows how to direct the tool”.
Where it stalls matches what the existing evidence on agents says: multi-step state, exploit development that needs a debugger, and anything where the next step depends on observing a live target. Our wider AI for CTF guide covers category-by-category strengths, and this guide stays with the Claude Code setup.
A good Claude Code CTF setup has three parts: a skills library, a short brief for each challenge and an isolated place to run tools.
The best-known option is ljagiello/ctf-skills, an MIT-licensed set of agent skills with about 3,700 GitHub stars, created in February 2026 and last pushed on 6 November 2026. Its README lists 12 skills: web, pwn, crypto, reverse, forensics, OSINT, malware, misc, AI and ML, a similar-writeup search, a writeup generator and a solve-challenge orchestrator that triages a challenge and routes it to the right category skill. Install it with npx skills add ljagiello/ctf-skills, and it also ships a script that installs the tools each category needs.
Two cautions. The similar-writeup skill searches the web for solutions to challenges like yours through the Tavily API, which is exactly what many events forbid during a live competition, so leave it out of anything but practice. And skills are code and instructions your agent will follow, so read them before you run an installer script, as our Claude Code bug bounty guide explains for plugins.
Put this in a CLAUDE.md or the first message, filled in per challenge:
Challenge: <name>, category <web|pwn|crypto|rev|forensics>
Rules: practice lab only. Do not touch any host except the target below.
Target: <host:port or file path>
Flag format: flag{...}
Do first: list files, read the description, state two hypotheses.
Never: submit flags yourself, install anything without asking, or search for writeups.
Log: write each hypothesis and its result to notes.md.The point of the last three lines is that you stay the author of the solve, which matters in a practice plan and in any event that allows AI as an aid.
Run the agent in a disposable VM or container with only the target reachable, and keep Claude Code’s permission prompts on. The Claude Code bug bounty guide covers permissions and the sandbox in more detail, and our MCP server security guide covers the tool-server risks.
Claude Code can quietly re-run a flagged CTF request on a different model, and Anthropic’s documentation says CTF work triggers this often. Its model configuration page says offensive security work, including penetration testing and Capture the Flag exercises, triggers fallback frequently, often on the first request, and calls it expected routing and not an account flag.
The practical effect for Claude Code CTF work is that your first hard prompt may run on an older model than the one you picked. Set Claude Code to ask before it falls back, so you can see it happen, and note that the page points organisations that need the top model for this work to Anthropic’s trusted access programs. Our best LLM for bug bounty guide compares the vendor programs and explains how to measure refusals on your own tasks, and why AI refuses hacking requests explains the underlying reasons.
Wrong submissions cost points or get you rate-limited in many events, so gate every flag before you submit it. This script checks the format, refuses repeats and stops after a set number of wrong guesses. It does not submit anything, which keeps the final step with you.
"""Gate flag submissions: check the format, skip repeats, cap wrong guesses.
Usage: python3 flagcheck.py 'flag{...}' (edit the three settings below)
Exit code 0 means "ok to submit by hand", 1 means "do not submit".
"""
import json, re, sys, time
from pathlib import Path
FLAG_REGEX = r"^flag\{[A-Za-z0-9_\-]{4,64}\}$" # copy the format from the challenge page
MAX_WRONG = 5 # many events penalise or rate-limit wrong flags
LOG = Path("attempts.json")
def load():
return json.loads(LOG.read_text()) if LOG.exists() else {"tried": [], "wrong": 0}
def main(candidate):
state = load()
if not re.fullmatch(FLAG_REGEX, candidate):
print("REJECT: does not match the flag format, so it is not a flag yet")
return 1
if candidate in state["tried"]:
print("REJECT: already submitted this one")
return 1
if state["wrong"] >= MAX_WRONG:
print(f"REJECT: {MAX_WRONG} wrong submissions already, stop and re-read the challenge")
return 1
state["tried"].append(candidate)
LOG.write_text(json.dumps(state))
print("OK: format matches, submit it yourself, then run: python3 flagcheck.py --wrong if it fails")
return 0
if __name__ == "__main__":
if len(sys.argv) == 2 and sys.argv[1] == "--wrong":
s = load(); s["wrong"] += 1; LOG.write_text(json.dumps(s)); print("wrong count:", s["wrong"]); sys.exit(0)
if len(sys.argv) != 2:
sys.exit("usage: flagcheck.py <candidate>")
sys.exit(main(sys.argv[1]))I ran it on a throwaway file: a well-formed flag passed, a repeat was refused, a malformed string was refused, and after five recorded wrong guesses it refused everything. Copy the real flag format from the challenge page into FLAG_REGEX.
Use a Claude Code CTF workflow to compress the boring parts and keep the thinking yourself, because the study found that the people who got the most from AI already knew how to direct it. A Claude Code CTF plan that works for learning:
Use practice labs and your own intentionally vulnerable apps for this, and keep events for the rules above.
So yeah, here is where we talk about our own product. I am biased, it is my company, and I think XHack is the strongest all-in-one alternative to a Claude Code CTF setup for practice CTFs and learning labs, for reasons you can check.
A Claude Code CTF setup asks you to assemble the skills, the brief, the sandbox, the refusal handling and the verification yourself. XHack combines an autonomous multi-agent AI agent, a continuous security platform and human testers, so the assembly is done.
Individual plans are $20, $49 and $150 a month, with a 7-day free trial, one per person. See the pricing page and the agent for bug bounty guide. The same event rules apply to XHack as to any AI tool, so check them before a live event. If you want people to run testing for you, managed engagements start at $2,500, and a free consultation is open even if we are not the right fit. Brutal honesty is kind of our thing.
Only if the event’s rules allow it, and they differ for every Claude Code CTF event. Hack The Box lets each event admin set AI to Disabled, Enabled or MCP Only. Holmes 2026 allows AI as an aid but bans it as a primary solver, and LakeCTF bans generative AI of any form. For a Claude Code CTF workflow in a live event, read the rules page and ask the organisers if it is unclear.
Claude Code CTF use is cheating if the event’s rules prohibit it, and fine if they allow it. Events such as Fluid Attacks run separate AI-Permitted and AI-Prohibited scoreboards, and organisers can revoke solves and ask for a walkthrough. In practice labs and your own challenges, Claude Code is a learning tool, and the rule is to keep the thinking yourself.
A Claude Code CTF request may be rerouted. Anthropic’s documentation says CTF exercises trigger model fallback frequently, often on the first request, which runs the request on a different model, and it describes this as expected routing and not an account flag. Set Claude Code to ask before fallback so you can see when your model changes.
The most visible Claude Code CTF option is ljagiello/ctf-skills, an MIT-licensed collection of 12 skills covering web, pwn, crypto, reverse engineering, forensics, OSINT, malware and more, with a solve-challenge orchestrator. I have not benchmarked it, so test it on practice challenges, and skip its writeup-search skill in live events.
A Claude Code CTF run’s cost depends on the model and the challenge. In the February 2026 study, the best agent configuration reached 4,900 points on a live CTF for roughly $95 to $96 in API usage, using Claude-family models from that period. Your Claude Code CTF cost will differ, so measure your own token use as our best LLM for bug bounty guide explains.
Organisers of Claude Code CTF-era events are split. LakeCTF says LLMs are too good at solving CTF challenges and bans them, while Hack The Box argues that banning AI will not prepare teams and calls CTFs a benchmark for the AI era. Its data also shows the best human team out-solving the best AI team in one event, so the format is changing and not ending.
A Claude Code CTF workflow is worth setting up for practice: skills for the categories, a short brief, a sandbox, a flag check and your own writeup. For live events, the Claude Code CTF rules come before the tooling, and they range from required to banned.
Re-check the Claude Code CTF rules and the tooling before each event, because organisers and models change quickly, and keep the thinking yours so the practice builds skill and not just a scoreboard.
Categories
Related articles
