How to use Copilot to assist a timed CTF
Copilot agent mode helped a timed security competition with files, scripts and browser tools. The participant restarted stalls and documented context drift.
linkedin.com
Suggested prompt
Suggested prompt written by Agents In Use, not the source author. Replace bracketed inputs and review tool permissions first.
Assist only with this authorized CTF challenge. Read the local files, generate small helpers and record tool outputs and progress. Break work into bounded steps, report interactive-tool stalls rather than waiting indefinitely and verify flags through the competition feedback before claiming a solve.
Reach people exploring AI agents
See placements →What happened
The participant reports ten competition solves with Copilot agent mode. Tool stalls and model/context drift required human intervention rather than a hands-off run.
Reported by Shubhankar Gaur — LinkedInHow the agent did it
- Gaur connected Copilot agent mode to file, tool and browser interfaces for the competition.
- Agents generated helpers and interpreted outputs while Gaur supervised and switched models.
- He manually restarted interactive tool stalls and reviewed solved-challenge feedback and context failures.
Where a person stepped in
Gaur supervised challenge work, restarted stuck tools, switched models and judged outputs; he explicitly identified inconsistent decomposition and context resetting.
Shubhankar Gaur used GitHub Copilot's VS Code agent mode during the Hack The Box Neurogrid CTF, switching among Claude, Gemini and Grok models. MCP supplied file and tool access, while Playwright handled browser interactions in the competition environment.
The agents helped with reading and editing files, writing helper scripts, parsing output and some small cryptographic and smart-contract tasks. The account is specific about where the loop broke: radare2 could wait for interactive input that never arrived, requiring Gaur to restart it manually. Browser automation also became unreliable as state grew more complicated.
Reasoning sometimes lost earlier context or invented paths. Gaur acknowledged that he had not consistently broken work into smaller steps, reset context or supervised decisions. Model switching itself consumed attention and tokens rather than automatically solving those problems.
The author reports ten solves and a completed competition run. That is an executed, timed lab result, not a general pentesting capability claim. Its useful checkpoints are actual challenge feedback, manual recovery from stalled tools and review of the agent's interpretation. Gaur also discloses receiving a swag voucher for the report, so the account's result and limitations remain clearly attributed to its participant.
Prompt
Suggested prompt (written by Agents In Use, not the author's)
Source: LinkedIn · Shubhankar Gaur
Frequently asked questions
Which agent interface was used?
GitHub Copilot Pro in VS Code agent mode, with several underlying models.
What needed manual recovery?
Interactive radare2 calls could freeze while waiting for input.
What did Gaur identify in his own workflow?
Inconsistent task decomposition, context resets and supervision.
More details
About this account
Gaur connected Copilot agent mode to file, tool and browser interfaces for the competition. Agents generated helpers and interpreted outputs while Gaur supervised and switched models.
Original firsthand competition article opened. Ten solves and placement are the author's report. A swag voucher for the report is disclosed. Model switching and hallucinated paths were limitations, not independent model rankings. Suggested prompt written by Agents In Use; no original task prompt was published in the verified account.
Credit: Shubhankar Gaur — LinkedIn
Source published 3 Dec 2025
Source checked 14 Oct 2026
Tools and topics
GitHub Copilot · VS Code · MCP · Playwright · radare2
Timed security lab · Tool stalls
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.