How to use Claude to organize parallel CTF tasks
Claude Code worked on CTF tasks in a prepared VM. The participant monitored terminals and steered attempts; competition feedback supplied clear results.
blog.includesecurity.com
Original prompt
Shared by the source author. See source notes for context.
solve this CTF challenge keeping track of progress
Reach people exploring AI agents
See placements →What happened
The participant reports solving almost every challenge using separate monitored sessions. Full release-monitoring and automatic-submission systems belonged to other teams.
Reported by Laurence Tennant — Include Security research blogHow the agent did it
- Tennant prepared a VM and scraped CTFd tasks into separate challenge directories.
- Claude sessions worked in separate tmux terminals with a progress-tracking request.
- The human monitored and steered attempts while comparing solved challenges with the competition's actual feedback.
Where a person stepped in
Tennant monitored separate terminals, steered the agents and manually attempted selected challenges while limiting the environment to a CTF VM.
Laurence Tennant used Claude Code at BSidesSF 2026 to tackle separate security challenges in parallel. He prepared a Debian VM with Python tools, Playwright and Ghidra through MCP, then used an agent-written scraper to save CTFd challenges into individual directories.
Each directory received a separate Claude Code session in tmux. The short request asked it to solve the challenge while keeping track of progress. Tennant moved between terminals, monitored the attempts and sometimes steered a model toward a better direction, while trying selected tasks manually himself.
The source reports that this approach solved almost every challenge, but was not fast enough to match the most automated teams. Their continuous release-monitoring and automatic submission pipelines were different systems, not capabilities Tennant claimed to have built during his run.
The account also explains the limits of applying those results elsewhere. A flag supplies a clear success signal in a bounded competition task; a real assessment requires business context, scope decisions and judgment about false positives and severity. The result is a documented competition workflow with separate contexts and human monitoring, not evidence that the same setup can safely perform a complete client pentest without supervision.
Prompt
Original prompt
Source: Include Security research blog · Laurence Tennant
Frequently asked questions
Why use separate directories and terminals?
They kept individual challenge work and context separate.
Did Tennant build the winning team's full automation?
No. He describes that pipeline separately from his own monitored sessions.
Why not equate this with a pentest?
Flags provide clearer success criteria than business-context and scope judgments in real assessments.
More details
About this account
Tennant prepared a VM and scraped CTFd tasks into separate challenge directories. Claude sessions worked in separate tmux terminals with a progress-tracking request.
Firsthand competition account opened and API date checked. Near-complete solves are self-reported; automation pipelines of winning teams are described separately and not attributed to Tennant. CTF success is not equated with unrestricted professional pentesting. Original prompt excerpt.
Credit: Laurence Tennant — Include Security research blog
Source published 23 Apr 2026
Source checked 14 Oct 2026
Tools and topics
Claude Code · Debian VM · tmux · Playwright · Ghidra MCP
CTF workflow · Bounded contexts
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.