Intro

Today I participated in the annual Cyber Defenders Discovery Camp CTF, Singapore’s largest national CTF, also a CTF in which I had, despite my best efforts, placed 2nd for 3 years in a row.

Joined by my long time teammate Jie Xu, returning face Ivan, and junior Meng Xiang, we clinched first place, full solving (with the exception of a probably impossible challenge) the CTF with 2 hours to spare.
If we had participated in the university category, we would also have easily achieved first place.

I have always dreamt of the day that I would finally achieve first place for CDDC, often envisioning the happiness I would feel when I could finally step down from crushing my juniors in local CTFs.

However, I felt no such thing this time around.

To understand how I ended up here and provide more context around my views, I should probably take a brief trip down memory lane.

Intro (but about me this time)

A short introduction of myself: I’m Joey, better known as kek or fishjojo1 online. I’m a CTF player specializing in web security, the founder of the Singaporean CTF team eidooheerfmaet, and I occasionally play with slight_smile/nus greyhats/uwubird.

I have been playing CTFs/involved in security work since I was 14, playing my first CTF (picoctf! btw, the new name sucks) with a senior (hi jiayang) during a CCA camp.

Prior to that, I dabbled in developing Growtopia cheats and reverse engineering malware that were distributed as cheats (those who know will remember deobfuscating and unpacking custom confuserEX obfuscations, the glory days of dnSpy and hardcoded email credentials in malware to send yourself a users user.dat).

In 2019, I founded eidooheerfmaet (teamfreehoodie but backward) with my friends Jie Xu and Ivan in order to compete in CTFs together. We chose this name because we were drawn to the free hoodies local CTFs would give out (I still have a closet full of them :p ).

I threw myself at CTFs because they seemed cool (wow! to be hacker!), taught me something new every single time, gave me a huge adrenaline rush whenever I solved a challenge, and allowed me to earn some pocket money whilst I was still a student.

CTFs taught me much of what I know about computers/system design. A good CTF challenge forces you to think. To understand completely the mechanism of the structure you are trying to break, then think in ways you have never thought before to tease out unexpected behaviour.

Thank you, CTFs

There is a certain art to CTFing at a high level. It is true that once you have done challenge after challenge, easier challenges can come as auto-solves for you.
Despite this, the great folks in the security community always come up with novel techniques, funny ideas and esoteric behaviours that make it so that every (good) ctf teaches you something new.

CTFing teaches you how to be different. It teaches you that somehow, someway, there is always a way. That in this beautiful dance of cat and mouse, the mouse always wins.

CTFs got me to think. They are genuinely one of the best applied competitions/scenarios that also force you to be creative and intelligent.

CTFs allowed me to realise that it’s possible to be the best. Being in an elite school surrounded by peers with olympiad backgrounds (since primary school), swaths of youth training (think abacus, olympiads, loads of tuition), I always (and still do!) felt like I never belonged. Like there was a chasm of skill between myself and my peers. I didn’t believe that it was possible to catch up, to be elite at anything.

When I first started playing CTFs, it wasn’t popular. My first “competitive” ctf, Sieberrsec CTF (hosted by my insane seniors) saw a player pool of maybe 20 real players? Hacking wasn’t considered an elite skill - the real geniuses went for the Olympiads. With such little competition, my modicum of computing interest/talent allowed me to place decently well and solve a few challenges - serving as great motivation for the then young me.

Lastly, I loved CTFs because they were fair. Anyone with an internet connection and mobile phone/shitty laptop could genuinely compete on the same level as someone with a big specced out desktop computer. The only advantage you had was your own skill.

What I have rambled about can be distilled into this: To win at CTFs, you had to learn.

The Era of Agents

CTFs today look very different from the CTFs of my day (especially so for the easier, local ctfs). Today, there is a clear dichotomy between learning and winning.

LLMs like gpt 5.5, opus 4.8 and friends have, in a short span of time, gotten really really good at security work (particularly ctfs) due to the ease of applying the technique of reinforcement learning to such challenges (due to the well defined reward function and it’s adjacency to coding/reading code).

They are so good, that even one single agent (without subagents) at a reasonably high TPS (100+) can come close to most of the best CTF players in the world at their own game. Obviously this is not true for everyone, but to illustrate myself as an example:

When opus 4.6 came out, I believed that in a heads up 1v1 challenge on moderately difficult web exploitation problems, I would win opus 4.6 slightly more than 50% of the time.

Now, I do not believe that I have a significant advantage (or if any at all!) against GPT 5-5. Perhaps the only thing I would be better at is really really hard challenges that require lateral thinking/a lot of creativity.

Consider the above, then consider that agents can be parallelized and scaled to an infinite ceiling. No matter how good of a security researcher you are, you are limited by your flesh and bones, by your typing speed.

Agents don’t stop. They don’t rest. They can be made not to give up.
You can trivially spawn a fleet of 100 agents to attack a problem.
If the problem is within the agents capabilities, there is no doubt that a fleet of agents will solve it faster than any human can. Attempting to fight against this is a futile exercise.

The only way a human can win, is if a problem is so difficult/out of distribution that is it genuinely out of the LLMs reach. Maybe only a handful of people on Planet Earth fit this bill (certainly not myself).

Therefore, especially at the beginner/intermediate/slightly advanced level, winning involves spinning up a fleet of agents to tackle the whole ctf. It is now a race of who can fully solve the CTF. By extension, it becomes a race of
a) who has the better harness
b) who has the better model
c) who has more money to spin up more agents

I can PROMISE you that this is the case for any ctf except the hardest ctfs. I can guarantee that if I threw all my codex accounts and my orchestrator at all but the hardest CTFs in the past year, I would place first for a vast majority of them.

The problem with this, is that when an agent solves a challenge, you don’t learn anything. You fail to go through the iterative process of reading, trying, failing and then finally succeeding that allows you to learn about things that the challenge might not even have tried to teach you.

You fail to practice using the terminal, writing solve scripts, reading code, and most importantly thinking. The relationship between winning and learning used to be proportional. Now, it is inversely so.

To win, you must sacrifice your learning. To learn, you must sacrifice your chances to win.

“But kek, one can still learn after the ctf!” I hear you say.
Admittedly, this is true. You can practice on your own without an LLM.
But which 15 year old is going to practice on their own without an LLM when the LLM can solve anything they throw at it? In the past 2 days, I’ve seen countless of competitors that very obviously don’t have a high degree of technical capability, but yet are solving challenges that are out of my depth (in non web categories, of course :p ).

CDDC 2026

My memory of playing CDDC for the past five years is this:

1. Sleep deprivation
2. Finishing the day so tired that I can barely open my eyes
3. Jumping and shouting at tables whenever teams solved a challenge they were stuck on
4. Adrenaline, lots of adrenaline

I am so incredibly devastated to say that today, I experienced none of these.
There were no shouts. No jumping for joy. No “YESSSSSS”. No “HOLY F**K”. It was just silence. Bags of meat prompting their agents to “solve this challenge”, “this is wrong” and “think harder”.

During CDDC2025, the combination of playing TIL (the ML competition that is held alongside cddc) and CDDC left me so drained that when I went home after a dinner with my team, my vision was starting to blur. I remember staying up late, skipping meals just to solve qualifier/finals challenges.

Today, for the first time in four years, I managed to have a proper lunch at CDDC. Perhaps the only positive from today.

Pictured: My mountain of food to make up for four years of missed MBS food

Anyhow, my point is that basically nothing that made CDDC feel special survived.
Here was how we won:

1. Got an agent to write a script to download all the challenges
2. Spin up my coding orchestrator that has 0 optimizations for ctf solving
3. “Challenges in XXX, please orchestrator agents to solve them and submit the flags for me”
4. ???
5. Profit

This is legitimately what I did. At some point, we solved a physical challenge that had possibly been red teamed by a opposing team, leaving the flag “very close to correct” as per the organisers who refused to give me the real flag.

I got so lazy to guess the flag that I asked my orchestrator to do it for me lol.

I derived zero satisfaction from solving any challenge because I had zero involvement in solving them. I only won because I had more accounts and a means to orchestrate agents better than everyone else.

CTFs are dead?

I believe that CTFs that do not exclusively focus on the hardest problems in the world are dead. They don’t really provide any value except for more data for frontier labs to RL/eval their models on.

On the learning side of things, I think that there isn’t much motivation for challenge authors to create easy challenges seeing that they would get slopped instantly, and beginner ctfs won’t have any learning value anyways.

You will only see me playing CTFs either for old times sake, to spend time with my friends, or if there is a particularly interesting challenge I wish to try.

I won’t attempt to debate the “next best format” here, but short plug: I am thinking of hosting an agentic zero day finding ctf that will be balanced monetarily (if you are interested in co-hosting this with me, or playing in it, do let me know!).

However, I do not believe that security is dead. Recent developments has shown us that the application of LLMs in frontier security research has been particularly effective and promising.

Runtime optimization work on improving the efficacy and efficiency of agents has been genuinely interesting and there are still swaths of zero days to be found.

My (probably not so great advice)

To those new to CTFs:
Learning about how computers work has been the best decision of my life. I do not regret any one second I have spent tinkering, playing with and fighting with a computer. Doing this brings so much value and joy to my life everyday and I will never stop loving technology.

My experience has taught me that two things make a highly efficient person:

1. Motivation (passion, the drive to be the best)
2. A solid grasp of the fundamentals/ability to learn

I can pick up almost technology/learn computing concepts really fast now because I spent my younger years attempting to wrestle with admin controls/failing pc parts/<insert nonsense I was trying to do>. The same cannot be said for subjects like mathematics. Fundamentals bring you so far. The skills are transferable across domains and the ability to learn will ALWAYS be the most important skill.

If you have a decent level of intelligence and with enough passion and drive, you can learn and do almost anything. Trust me.

Therefore, if you are new, I encourage you to learn.
Learn to learn and love to learn. Be curious. Do the things your peers won’t, find an interest and go so deep into it that you can call yourself the top 0.1%. When you see a problem, think of “why” and don’t reach for the “how”.

AI/LLMs are perhaps the greatest field levellers in human history. Use them as learning tools and teachers. They are infinitely patient, can explain almost any concept to you, and you can prompt them/build skills to make them teach you in a way you learn best.

You’re in an era where you can literally learn anything you want at a pace that no generation before you could. Most of your peers will get lazy and slop their way through life. By just being better than them, you will automatically sort yourself into the top 1%.

To the general audience: I do not believe that we are close to the optimal structure for representing intelligence. Like it or not, the agents are getting smarter day by day.

No one has any clue what they are doing now. Anyone who claims they have the “best orchestrator” or the “best skill” is nothing short of full of shit. With good engineering ability and some intellect, the possibilities open to you are endless.

Make use of it, use the agents as an amplifier to your skill and a medium for which you can express your talents. Be adaptable and fluid.

End

This probably hasn’t been very coherent as I am not proof reading this and spammed it out in the past hour.

On my way back home a few hours ago, I teared up after remembering the good times I had whilst playing CTFs just a few years ago.

I am eternally grateful to every CTF I have played and all my friends I have made along the way. Shoutout to my team eidooheerfmaet and everyone who has played a part in it. To the other team in my batch, slight_smile, though I might have lost to you guys at every competition, you made me want to improve and I was always proud to share the stage with you. To the other local teams (t0x1c v4p0ur, nus greyhats, youtiaos, thegout, nushmallows, SEE, etc), thank you for making the CTF community what it is today.

I cannot describe how thankful I am to have played and started my ctf career in an era without agents. I do not doubt that if I had started today, I would probably fall into the trap of slopping too (given my lazy nature).

And to every CTF I have played: CTFing got me out of some tough times and gave me an identity. It taught me that I could do it, and more importantly, how to lose. CTFs meant the world to me.

I will miss CTFs.