← Glossary Term
Capture the flag
A security exercise where you are told a secret is hidden on a system and asked to break in and retrieve it.
Capture the flag, often abbreviated CTF, is the standard training and testing format in computer security. A “flag” is a piece of secret text placed somewhere in a system, and your job is to find a way in and read it. No method is prescribed, which is the point: the exercise measures whether you can find any route at all.
AI labs now use the same format to measure what their models can do offensively, since a score on a set of CTF challenges is a concrete number rather than a guess. The catch is that a capture-the-flag prompt is, by design, an instruction to attack something, so the sandbox around it has to be watertight.
Mentioned in