The Cyber Reasoning Challenge (CRC) is an AIxCC-style competition in which student teams design a cyber reasoning system (CRS) to find and patch vulnerabilities in real software targets. Unlike a traditional CTF, teams do not solve challenges by hand. Their CRS must autonomously discover a crashing proof of vulnerability and produce a patch that compiles, preserves the program’s intended behavior, and actually fixes the bug rather than hiding a single crash.
To keep the event focused on system design, we have used the evaluation infrastructure from Team Atlanta, the first-place team in DARPA’s AI Cyber Challenge. Teams therefore do not need to build the evaluation pipeline, scoring, or target-harnessing stack from scratch. They can spend their time on the CRS itself: how it searches, localizes, and repairs bugs.
We also provide a starter kit with two working CRS baseline (codex and claude code). Teams can run it out of the box to understand the workflow, then replace or extend the finder and patcher with their own components.
CSAW CTF is designed for students who are trying to break into the field of security, as well as advanced students and industry professionals who want to practice their skills.
Open to all skill levels. Teams compete within their respective global regions.
Challenge Details
CSAW CTF is one of the oldest and biggest CTFs with 1216 teams with 1+ points in 2021. Designed as an entry-level, jeopardy-style CTF, this competition is for students who are trying to break into the field of security, as well as for advanced students and industry professionals who want to practice their skills.
CSAW CTF occurs over two rounds: a 48-hour Qualifying Round in September and a 36-hour Final Round in November.
Challenge writers who are associated with or alumni of active teams have recused themselves from playing in or supporting teams playing in CSAW CTF.
Judging Criteria
Jeopardy-style scoring. Teams earn points by solving challenges across standard CTF categories. The team with the most points at the end of each round advances.
Top teams from the Qualifying Round are invited to the Final Round.
Registration Guidelines
Register via the CTF platform. Teams compete within their respective global regions.
Contact csawctf@osiris.cyber.nyu.edu for registration questions.
Submission Guidelines
Challenges are submitted through the CTF platform during the competition window. Flags must be submitted in the correct format as specified per challenge. All submissions are final once entered.
Timeline
Items
48-hour Qualifying round begins
UTC
ONLINE
Qualifying Round Ends
UTC
ONLINE
Finalist Notification
EST
End of September
36-hour Final Round Begins
EST
Hybrid mode, region dependent
Final Round Ends
EST
Note
All times listed in UTC or EST as noted per event. Final Round format (online vs in-person) depends on region.
Each challenge has its own details for the competition. Those details are given on the GitHub for this competition here.
Challenge 1: The first challenges will focus on leveraging generative AI to add hardware Trojans to an AES core. Three difficulties of challenge will be provided: easy, medium, and hard, with each worth increasing points. Teams can submit all three difficulties of challenge to earn the most points.
Judging Criteria
Each challenge will have its own rubric regarding how points can be awarded. Challenges will have their base functionality automatically graded, and manual judging will take place over the following days to ensure all rules were followed, as well as to award additional points for completing further objectives. These extra points will be awarded for each competition for things like “most creative use of AI”. Please refer to each challenge's rubric for how this will be done.
Each submission must also be fully open source, guidelines for this are here.
Registration Guidelines
Please fill out the registration Google Form to register your team. Teams must consist of:
Up to 4 student team members
One team advisor/mentor
Timeline
Items
First challenge given
EST
Second challenge given
EST
All challenges due
EST
Finalists announced
EST
Final challenge given
EST
Winners announced
EST
Note
Note: The challenges do not need to be completed within the month they are given, this is just when we are releasing them. We will also update a monthly leaderboard in this repository as the competition progresses. All teams will have up until the 1 October deadline to submit their challenges to earn points and be considered as a finalist team.
ESC is an educational, research-oriented tournament aimed at hacking into the hardware of embedded systems. First run in 2008, it is the oldest hardware security competition in the world, and 2025 represents ESC's 18-year anniversary.
Past ESC competitions have focused on data exfiltration attacks against IoT devices, hacking the firmware of a RISC-V Wi-Fi access point and executing acoustic side channel on 3D printing devices.
The 2025 ESC competition centers on side channel attacks (SCAs) and fault injection attacks (FIAs), techniques used to extract sensitive data from infrastructure-critical cyber physical systems. Participants will engage in a series of challenges that involve designing and executing these attacks, as well as investigating methods to defend against them. The ChipWhisperer Nano will serve as the target hardware platform, providing teams with a safe and controlled setting to showcase their expertise in launching and mitigating these advanced attack strategies.
The event comprises a qualification and a final/competition phase where teams will be able to explore several variations of fault injections and side channels, as well as suggest mitigations for the discovered exploits.
CSAW CTF is one of the oldest and biggest CTFs with 1216 teams with 1+ points in 2021. Designed as an entry-level, jeopardy-style CTF, this competition is for students who are trying to break into the field of security, as well as for advanced students and industry professionals who want to practice their skills.
CSAW CTF occurs over two rounds: a Qualifying Round in September and a Final Round in November.
This "Best Paper Award" assesses the top scholarly security research from the previous year. The focus of this competition is on research that has a practical impact. With eligibility limited to already published papers or camera-ready papers, CSAW has a reputation for drawing some of the best security research worldwide.
It’s time to think a little differently about the capabilities of generative AI for chip design
Description
Participating teams will be tasked with leveraging AI tools, such as LLMs, to insert and exploit hardware vulnerabilities and Trojans for various open-source hardware designs. These can include cryptographic accelerators, processors, communication IPs, etc.
Each month leading up to the in-person final at CSAW, a new challenge (or challenges) will be issued. Each of these challenges will remain available for the duration of the competition until the finalist teams are selected so new teams can join at any time. At the conclusion of each month’s challenges, a winning team will be selected and awarded a small hardware prize.
Potential challenges could include:
Inserting a Trojan that can evade detection by state of the art security analysis tools and models.
Modifying security checks to allow a Trojan-infected hardware module to pass verification.
Modifying a design to make it more vulnerable to potential side-channel attacks.
All challenges must be completed using AI tools and all information regarding those tools must be submitted, including complete and detailed logs of their use, i.e. if an LLM is being used, we require all conversations with the model be submitted.
