HalCTF: A DEF CON Contest Where Agents Do the Hacking
At DEF CON 34's AI Village, a new capture-the-flag contest called HalCTF removed humans from the actual hacking: teams submit containerized autonomous agents that must find and exploit sandboxed targets on their own, scored by rules built to reward small, efficient models over raw compute.
HalCTF — the Hostile Autonomous Layer CTF — ran August 7-9, 2026, at AI Village during DEF CON 34 in Las Vegas. It is, by its organizers' description, a first-of-its-kind agentic security competition: participants do not interact with the challenge targets themselves. Instead, they design and submit an autonomous AI agent, then watch it navigate sandboxed environments, exploit vulnerabilities and capture flags entirely on its own.
The build step is a software engineering exercise as much as a security one. Competitors package their agent as an OCI-compliant Docker container, up to 2.5 GB, and upload it through AI Village's web console, or they can skip building one and run the built-in reference agent instead. That reference agent uses a hand-rolled Thought/Action/Observation loop with two available actions, run_shell and submit_flag, running on a trimmed Kali Linux base stocked with tools like sqlmap, impacket, john and gdb. Teams range from solo entrants to groups of five.
Once submitted, an agent runs inside an isolated gVisor sandbox with no direct internet access — it can reach only a local proxy that handles its LLM calls and its interactions with the challenge targets. That isolation matters for a competition whose whole premise is autonomous exploitation: it keeps an agent's actions confined to the intended playing field regardless of what the agent itself decides to try.
Scoring is built around a deliberate handicap system rather than a flat per-flag tally. Each challenge carries a base value that decays as more teams solve it, so earlier solves are worth more. Competitors can buy up to five hints per challenge — the first is free, each additional one costs 25% of the challenge's current value, with a floor that prevents a team from finishing net-negative. Two further multipliers apply on top: a bonus for using a smaller model and a penalty for burning excessive LLM tokens, both of which lock in permanently the moment a flag is submitted.
Those multipliers are the point of the whole exercise. All inference for competing agents runs through a centralized Model Service, an OpenAI-compatible endpoint that primarily offers open-source, smaller models rather than frontier ones. AI Village's organizers describe the format as designed around "how far you can stretch small local models that almost everyone can run" — an explicit attempt to score agent design and efficiency rather than which team could afford the most compute or the largest model.
The first-place prize is an Nvidia DGX Spark, a local AI workstation, which fits the same theme: a reward for continuing to build agents that run on hardware a person can own outright, rather than renting a frontier model's API. Coverage of the event framed it as part of a broader shift — autonomous AI exploits moving from something that happened privately, or by accident, into a structured, public competitive format with rules, sandboxing and a scoreboard.
As of this writing, AI Village has not published final standings or a winning team for HalCTF's inaugural run. The competition's own design, though, already answers the more interesting question for a first edition: not who won, but what the organizers decided was worth measuring — and they chose efficient, well-architected autonomous agents over sheer model size.