• Teams consist of one to four current college or university students and may list one advisor. A participant may belong to only one team.
• After a scored run begins, discovery and patching must be performed by the team’s submitted CRS. Human intervention is not allowed.
• Teams may use fuzzers, static or dynamic analysis, language models, agent systems, and other legally obtained tools, and must follow the licenses and terms of those tools.
• Use competition targets and infrastructure only for CRC@CSAW participation, research, and education. Do not attack competition infrastructure, other teams, external services, or systems outside the released challenge environment.
• Submit only artifacts produced for the registered team. Do not include credentials, private keys, tokens, or personal data.
• Do not disable the harness, tests, build system, or vulnerable feature to obtain a passing result. 
• All participants must follow the CSAW Code of Conduct.
• Organizer verification is authoritative. Organizers may reject a submission or disqualify a team for violating these rules.

Full detailed rules are available here.

Challenge writers who are associated with or alumni of active teams have recused themselves from playing in or supporting teams playing in CSAW CTF.

- Each team will compete from their own region — US/Canada teams compete within the US-Canada region only.
- Submissions must reflect your team's original creativity, insight, and technical effort.
- Finalist teams are responsible for arranging and covering their own transportation to the venue. Travel support will not be provided.
- Teams must submit a short technical report (template provided) and a 4–5 minute demo video.
- Preliminary teams must answer five open-ended questions covering: experience with 3D printing, AI/ML/DL expertise, and proposed attack/defense strategies.

• Team Participation: Teams of up to 3 people are allowed. Individual participation is also possible, but teamwork is highly recommended.
• ​Agentic Framework: Participants are encouraged to analyze the general patterns of the challenges to optimize their agentic systems to make it specific for CTF automation; however, the final solutions must be generated entirely by an autonomous, LLM-powered agent, with no human-in-the-loop during execution. Participants are allowed and encouraged to use any techniques applicable to building effective agentic AI systems, including but not limited to prompt engineering, multi-agent, tool-augmented reasoning, and retrieval-augmented generation (RAG). These techniques may be applied broadly or tailored to specific challenge categories, but must remain generalizable—challenge-specific hints or hardcoded solutions are strictly prohibited. All the prompts used for challenge solutions must not include direct solutions from human players from any source; each solution that violates this rule will not be counted as solved. Participants must supply their own API tokens or model deployments for use within their autonomous frameworks. Any agentic framework may be used—including doing enhancements on open-source agentic frameworks, or custom-building systems from scratch. These frameworks must support full automation and may integrate real-time or pre-installed cybersecurity tools such as apk2jar, apktool, Ghidra, Hopper, Burp Suite, and Wireshark. All aspects of model selection, tool configuration, and system design are open-ended and left to the discretion of the participants.
• Model Requirements: Participants are free to use any language model architecture for their agentic systems, including models accessed via API service providers (e.g., OpenAI, Anthropic), self-hosted open-source models (e.g., LLaMA, Qwen), or custom fine-tuned variants. There are no restrictions on model size, origin, or hosting setup. However, all models must be free of contamination, meaning they must not have been trained on or contain leaked solutions or flags from the competition dataset. Any evidence of flag leakage or training contamination will result in disqualification.
• Evaluation: will be based entirely on the number of challenges successfully solved by the autonomous agent. Each correctly solved challenge contributes to the team’s final score, with no partial credit. The accuracy of the extracted flag, as verified against the ground truth, is the sole criterion for success.
• Submissions: For each solved CTF challenge, participants must submit the full trajectory generated by their autonomous agent, including the agent’s thoughts, actions, observations, and the final flag, in a machine-loadable format (e.g., JSON or structured log). The extracted flag must exactly match the ground-truth flag provided in the metadata. Manual editing or tampering of the agent outputs is strictly prohibited and will result in disqualification. In addition, participants must provide a well-documented Git repository containing the complete codebase of their agentic framework. Open-source is encouraged, but a private repository shared with the organizer is also doable. This repository should include all dependencies, configurations, and tools used, along with detailed technical documentation outlining the participant’s approach—such as prompting techniques, model usage, agent architecture, tool integration, and any other implementation details. If a custom or fine-tuned model is used, training code and model weights should also be provided for validation.
• API Keys and Data: All competitors may request API keys from OpenAI, Anthropic, and Gemini from the organizer, with an initial combined budget of up to $100 in credits every month during the competition. This budget may be extended as needed. Requesting API keys will automatically register participants for the competition. All competitors are required to open-source the code and data used in their submissions.