# KubeArmor AI CTF

The **KubeArmor AI CTF** is a browser-first security challenge where players attack AI systems rather than traditional infrastructure. No local tooling required, everything runs in the browser, and every challenge is designed to expose how modern LLM-powered applications can be broken.

The event is built on [KubeArmor](https://kubearmor.io), an open-source runtime security engine for Kubernetes. I co-created the platform, built it in a single day, and designed the challenges.

- **Play it**: [ctf.kubearmor.io](https://ctf.kubearmor.io)
- **Event page**: [kubearmor.io/ctf](https://kubearmor.io/ctf)
- **Build journal**: [How I Built a Full AI Security CTF Platform in One Day](https://blog.atharvashah.com/p/vibe-coding-a-full-ai-security-ctf-platform-in-24-hours)

The CTF ran live from 18 June to 21 June 2026, a four-day event with over $1,000 in prizes.

![AI-CTF 2026: three tracks, eighteen flags, a four-day event and over $1,000 in prizes](/projects/images/ctf-hero.webp)

## The Premise

As AI gets embedded into production systems, a new class of vulnerability emerges: LLMs that can be manipulated through their inputs, agents that can be hijacked through their tools, and APIs that reveal more than they should. This CTF teaches those attack surfaces through hands-on challenges.

## Three Tracks

![The CTF challenge runner, where players talk to ARGUS, ORACLE and HELIOS](/projects/images/ctf-2.webp)

### Prompt Injection Lab (1,000 pts)
Five challenges focused on breaking instruction hierarchies. Players learn to override system prompts, drift an AI's persona, poison its context window, and bypass output filters, progressively more layered as the track advances.

### Agent Workflow Hijack (1,000 pts)
Five challenges targeting AI agents that use tools. Players exploit tool-routing logic, inject malicious data into search results the agent trusts, skip approval gates, poison agent memory, and chain exploits across a multi-tool pipeline.

### Hidden API & Guardrail Bypass (1,000 pts)
Five challenges around API surface abuse. Players find debug endpoints, tamper with safety mode flags, leak transcript exports, intercept streaming chunks, and replay preview tokens to extract secrets the API never intended to surface.

## 15 Challenges + 3 Bonus Flags

Each track ends with a master bonus challenge worth extra points. Total possible score: 3,000 points.

| Difficulty | Count |
|---|---|
| Medium | 6 |
| Hard | 9 |
| Bonus | 3 |

The bonus flag in each track only unlocks after a player collects all five fragments from the other five challenges in that same track.

![The CTF sandbox view](/projects/images/ctf-1.webp)

## Flag Format

```
KA{pil_challenge-slug_secret}
KA{awh_challenge-slug_secret}
KA{hag_challenge-slug_secret}
```

## The design decision that made it work

Scoring is separate from gameplay, and every solve check is deterministic.

An LLM decides how good the conversation feels and which clues it releases. A pattern match decides whether the flag opens. That split means a model update cannot break a live challenge during an event, which matters enormously when a hundred people are playing at once and you cannot ship a hotfix.

The proof is the fallback mode. Run the platform with no Anthropic API key at all and every one of the eighteen challenges stays solvable.

Each challenge carries four parts: a system prompt that sets the AI persona, solve patterns as strings or regular expressions, an action catalog of preset buttons that fire scripted tool calls, and optional per-player state for multi-step puzzles.

## Scoring and rewards

![The live leaderboard](/projects/images/ctf-4.webp)

![Flag submission](/projects/images/ctf-3.webp)

Official registration and scoring ran through CTFd. The custom browser app handled the game itself.

The top three finishers took a $100 Amazon gift card each plus a swag bundle of a KubeArmor t-shirt, stickers, a notebook and a water bottle. Every contestant received a certificate.

Three bonus-point actions qualified a player: star the KubeArmor repository, join the CNCF Slack channel, and follow KubeArmor on LinkedIn. Gameplay doubled as community growth.

## Who It's For

Security engineers and developers who want hands-on experience with AI-specific attack patterns, prompt injection, agent exploitation, and API abuse, in a safe, controlled environment. No prior AI/ML background required; familiarity with browser DevTools and HTTP basics is sufficient.