cd ~

soon-haari

Unravelling Hacksium 2026

This post does not represent the views of any organizations I’m affiliated with or of other members of young (coo).

DEFCON CTF finals was happening during the second weekend of August, and a qualifier of a local CTF called Hacksium was also happening. As I was not playing DEFCON CTF, I participated in the event as team young (coo). 20 teams were set to advance to the finals, and around 80 teams had nonzero points around the end of the contest. The total prize money was announced to be 10,000,000KRW, which is around 7,000USD at the time.

What happened?

The contest rules clearly prohibited the use of AI beyond basic search purposes.

Flag hoarding was also strictly prohibited. The rules explicitly state that the purpose of this restriction was to ensure the reliability of recorded solve times.

We, young (coo), tried to follow the rules and solve every challenge with bare hands. While we were trying our best, the scoreboard showed that a surprising number of teams were solving challenges incredibly quickly, at a pace that wasn’t even remotely close to ours.

After a few hours of tryharding, we were honestly getting burned out, especially since the overall challenge quality wasn’t exactly the best. But that’s unrelated to the point of this post, so I won’t bring it up again.

Since it was already pretty clear that we weren’t going to make the top 20 anyway, I stopped focusing on the challenges and got curious about how other teams were solving them so quickly. I ended up collecting their solve logs through a simple public endpoint, /teams/8xx/, which exposed team information, member information, and most importantly, solve timestamps.

The only public information I had access to was the solve timestamps and the organizers obviously have much more detailed logs that I cannot access. I did what I could.

Conversation with the organizers

After the contest ended, we shared the gathered logs and our analysis with the organizers through a ticket.

The organizers said they would review the materials we submitted and conduct their own verification using the logs and records available to them. We really appreciate them taking the issue seriously and looking into it further.

Some statistics

This is the log we collected, with all player names replaced by their SHA256 hash digests including salt. Again, the solve timestamps themselves were completely public for every participant. You can view the logs and the running filter JS/Python script here.

I also made a simple module to filter and analyze the logs based on selected conditions. As flag hoarding is banned, this test was made under the assumption that the time between two solve logs is the maximum possible time for a solve. Being flagged by it does NOT guarantee that a team or individual cheated. It simply means that, in my opinion, their activity is worth taking a closer look at.

A member is flagged as suspicious if they meet at least one of the following criteria:

  • Criterion A: Three consecutive solves are recorded within A minutes, measured from the first solve to the third.
    • This means a player solved 2 challenges in A minutes.
  • Criterion B: Two consecutive solves are recorded within B minutes.
    • This means a player solved a challenge in B minutes.
  • Criterion C: At least two consecutive-solve intervals are each no longer than C minutes. These intervals do not have to be adjacent.
    • This means a player solved a challenge in C minutes two times.

Solve sequences that fall entirely within unexpected events, such as all instances suddenly getting fixed, are excluded for fairness.

Personal thoughts

So I guess this part is the main purpose of the entire post.

First of all, I apologize for the rather alarming post with an offensive vibe. However I decided some words must be spoken.

I understand that the connection between AI and CTF in 2026 has been a gigantic topic that has no clear answers yet. It’s more than obvious that without AI, it’s impossible to beat teams in a CTF contest assuming everyone is tryharding for a nice prize.

I myself recently participated in Hacktheon CTF Finals and SCAN CTF Quals and it was completely AI-assisted with negligible brainpower. I can’t say I’m very proud of it, but a win is a win and a prize is a prize.

AI use in CTFs has been like this for a while now, and I think even DEFCON Finals is going the same way, it’s inevitable now.

Banning AI in CTFs

Some attempts have been made in some CTFs, to keep the fun in CTFs as no one enjoys running AI without thinking (looking at it as an org is even way more painful).

One of them was making a separate scoreboard for humans who don’t use AI voluntarily. Prizes do not matter in the case so if you’re going for the prize, it’s stupid not to use AI, however this idea was made to save some brain using fun. I understand both the opinion that this is a meaningful move and the opinion that it changed nothing.

  • However, this doesn’t have a problem only because it’s volunteer-based and there’s actually no restriction.

DiceCTF Finals this year is happening this month, and it is also AI-restricted for classic hacking challenges. DiceCTF, LakeCTF, etc… these kinds of CTFs don’t have a cash prize (I think) for the finals competition, because they aim to be an enjoyable event.

  • However, this doesn’t have a problem(or not as big as Hacksium’s case) only because the prize ain’t big.

I participated in this year’s FCSC, which strictly banned AI except for basic searches like Google Search’s built-in Gemini.

  • The competition lasted extremely long compared to other CTFs, and I saw organizers proactively contacting players with suspicious logs, to ask about the solution. (Also the prize isn’t cash, it’s an ECSC trip only for people in France but I never managed to understand how ECSC works anyways.)

Out of context, I had extremely good memories of FCSC 2025, so I made my young (coo) friends do an internal competition, with a small prize for ourselves. I won legally, believe it or not.



When there’s a cash prize of total 7k and there’s a full AI-restriction? Problem begins.

Dura lex, sed lex

I completely understand, no, understand isn’t the right word.

I empathize with the teams who used AI for Hacksium. We got a terrible score, and there were so many challenges that required guessing. Not that we humans are better than AI in any challenges but those kinds of things are extremely easy for AI, they’re just not meant for humans.

However, I feel like it should be treated differently if it’s in the RULE. Like, if you think the competition’s rule is stupid, then just don’t play? You must follow the rules if you decided to participate.

I’m not writing this to:

  • Shame everyone who’s flagged in the filter list, even though seeing some people I know irl there made me terribly sad.
  • Convince the organizers to ban as many teams as possible so that young (coo) can proceed.
    • It really is not, please trust

I’m writing this because I think this is something that should never happen again, and some things must be learned and changed in players’ minds.

There will always be cheaters, that’s inevitable. However the MAJORITY breaking the rules? This is an abnormal emergency, it’s not just a happening.


Of course, for small-gap timestamps you can make excuses like:

  • I saw the flag coming out of the solver late, so I mass submitted.
  • I suddenly broke the bottleneck for the solve, for multiple challenges.
  • Teammates passed me a 99% done solve, and I just finished the final parts.
  • I’m just that much better than you.

And there’s no way to disprove them but cmon, you know you used AI. You know that I know you used AI. The only valid excuse is “I didn’t read the rules” and it’s still your fault.

And again I don’t mean to tell you “you’re bad”, I want to tell you “Please think again about what the right choice is”.


Let’s see the cases for restricted number of members with a big prize, like Codegate or BHMEA Finals.

Did the majority ask an external member for help, to get a better score? I’m sure some teams did but again, cheaters always exist. But at least it’s not completely fucked as if every team used an external member. Or am I optimistic and was my team the only team who kept the rules? hehe

What I want to say is that using AI in Hacksium is completely equivalent to playing with 100 members in BHMEA for 80k.

Questions for ourselves

We should have some questions for ourselves and think about them from both organizers’ and players’ perspectives.



Why did no one care about the rules in this case?

This is kinda funny, as you can cheat in codegate finals as well if you really meant to. I feel like it’d be even easier to cheat without getting caught.

I fear that the reason is, everyone, especially Koreans, has just gotten too used to playing CTFs with AI recently thanks to RubiyaLab and TeamH4C, and it’s not a bad thing. It’s a smart move. However I’m just saying it just might have affected it a little bit.

Also the challenges may not have been too enjoyable to solve by hand. But idk.

One may consider it’s lame not to cheat when everyone else is cheating. Which I don’t agree though.

Can you ask yourself why you ignored the rule?



Is it even possible to ban AI in CTFs now? Was it Hacksium’s fantasy?

Idts. Kinda yeah.



Can one make an enjoyable CTF without AI restrictions?

No one knows but if you have anything, claim a bonus 100K here.

Should be really really hard though I think.