arXiv: The Disruptive Impact of Large Language Models on Capture the Flag Competitions and the Path Toward Fair Play

This paper, published on arXiv, analyzes the disruptive impact of large language models on Capture the Flag cybersecurity competitions, which are widely used for talent assessment and training. It identifies how LLMs can now autonomously solve many challenges, undermining the validity of these competitions as a measure of human skill. The paper proposes a framework for fair play, including human-only verification, modified challenge design, and new scoring methodologies to preserve the integrity of these events.

The primary affected organizations are cybersecurity firms, government agencies, and academic institutions that rely on Capture the Flag competitions for recruitment, training, and certification. Additionally, any sector using gamified security assessments, such as financial services or critical infrastructure operators, should take note. The findings also impact vendors of cybersecurity training platforms and professional certification bodies.

Compliance teams should immediately review any internal or third-party cybersecurity assessments that use Capture the Flag formats to determine if they are vulnerable to LLM-based cheating. They should engage with competition organizers to verify that human-only controls or anti-LLM measures are in place. For regulatory reporting, teams should document any reliance on these assessments for skills validation and consider alternative evaluation methods until standardized fair play protocols are adopted.