Competitors should structure their proposed policy solutions within one of the following key focus areas:

• Focus Area 1: AI Security and Liability
  • How can markets be restructured to prioritize secure AI development without stifling innovation?
  • What constitutes a "reasonable precaution" when developing or deploying AI systems, and how can it be measured?
  • How can liability rules account for the role of AI code generation, dataset curation, and poisoned training inputs?
• Focus Area 2: Global Impact and Best Practices
  • How are different countries approaching AI system liability and assurance, and what can be learned from them?
  • Is a global standard for AI system resilience feasible, and what enforcement mechanisms might it require?
  • How should the open-source AI movement be integrated securely into the global ecosystem?
• What Needs to Be Covered?
  • Policy Proposal: Propose structured plans for policies that address liability, assurance, and resilience in AI development and deployment.
  • Guidelines and Standards: Reference frameworks such as the NIST AI Risk Management Framework or Secure Software Development Framework.
  • Safe Harbor Frameworks: Consider how organizations that follow recognized best practices could be protected.
  • Stakeholder Collaboration: Highlight cooperative dynamics between government, private sector, academia, and open-source communities.

Submit Papers to the Google Form by October 25th, 2025.

Full detailed rules are available here.

Challenge writers who are associated with or alumni of active teams have recused themselves from playing in or supporting teams playing in CSAW CTF.

- Each team will compete from their own region — US/Canada teams compete within the US-Canada region only.
- Submissions must reflect your team's original creativity, insight, and technical effort.
- Finalist teams are responsible for arranging and covering their own transportation to the venue. Travel support will not be provided.
- Teams must submit a short technical report (template provided) and a 4–5 minute demo video.
- Preliminary teams must answer five open-ended questions covering: experience with 3D printing, AI/ML/DL expertise, and proposed attack/defense strategies.

• Team Participation: Teams of up to 3 people are allowed. Individual participation is also possible, but teamwork is highly recommended.
• ​Agentic Framework: Participants are encouraged to analyze the general patterns of the challenges to optimize their agentic systems to make it specific for CTF automation; however, the final solutions must be generated entirely by an autonomous, LLM-powered agent, with no human-in-the-loop during execution. Participants are allowed and encouraged to use any techniques applicable to building effective agentic AI systems, including but not limited to prompt engineering, multi-agent, tool-augmented reasoning, and retrieval-augmented generation (RAG). These techniques may be applied broadly or tailored to specific challenge categories, but must remain generalizable—challenge-specific hints or hardcoded solutions are strictly prohibited. All the prompts used for challenge solutions must not include direct solutions from human players from any source; each solution that violates this rule will not be counted as solved. Participants must supply their own API tokens or model deployments for use within their autonomous frameworks. Any agentic framework may be used—including doing enhancements on open-source agentic frameworks, or custom-building systems from scratch. These frameworks must support full automation and may integrate real-time or pre-installed cybersecurity tools such as apk2jar, apktool, Ghidra, Hopper, Burp Suite, and Wireshark. All aspects of model selection, tool configuration, and system design are open-ended and left to the discretion of the participants.
• Model Requirements: Participants are free to use any language model architecture for their agentic systems, including models accessed via API service providers (e.g., OpenAI, Anthropic), self-hosted open-source models (e.g., LLaMA, Qwen), or custom fine-tuned variants. There are no restrictions on model size, origin, or hosting setup. However, all models must be free of contamination, meaning they must not have been trained on or contain leaked solutions or flags from the competition dataset. Any evidence of flag leakage or training contamination will result in disqualification.
• Evaluation: will be based entirely on the number of challenges successfully solved by the autonomous agent. Each correctly solved challenge contributes to the team’s final score, with no partial credit. The accuracy of the extracted flag, as verified against the ground truth, is the sole criterion for success.
• Submissions: For each solved CTF challenge, participants must submit the full trajectory generated by their autonomous agent, including the agent’s thoughts, actions, observations, and the final flag, in a machine-loadable format (e.g., JSON or structured log). The extracted flag must exactly match the ground-truth flag provided in the metadata. Manual editing or tampering of the agent outputs is strictly prohibited and will result in disqualification. In addition, participants must provide a well-documented Git repository containing the complete codebase of their agentic framework. Open-source is encouraged, but a private repository shared with the organizer is also doable. This repository should include all dependencies, configurations, and tools used, along with detailed technical documentation outlining the participant’s approach—such as prompting techniques, model usage, agent architecture, tool integration, and any other implementation details. If a custom or fine-tuned model is used, training code and model weights should also be provided for validation.
• API Keys and Data: All competitors may request API keys from OpenAI, Anthropic, and Gemini from the organizer, with an initial combined budget of up to $100 in credits every month during the competition. This budget may be extended as needed. Requesting API keys will automatically register participants for the competition. All competitors are required to open-source the code and data used in their submissions.