General Rules
- Any inappropriate, insulting, disrespectful or prejudicial team name is forbidden
- Any attempt to alter the equipment on site or to change the network access to the tables is forbidden
- Any attempt to contaminate other teams or HFCTF staff by any means whatsoever is prohibited
- Any attempt to set up a hotspot, fake scoreboard, Wi-Fi scan, etc. is prohibited
- Any attempt to use the CTF infrastructure as a proxy to attack elsewhere is prohibited
- Denial of service is prohibited
- Do not use brute force the flag submission system
- Do not give out flags or writeups during the competition
- Do not tamper with flags
- Do not ruin the fun of the event for other participants
- Be courteous and respectful
- If something seems broken, let the challenge designer know on Discord or come to see us in person
- Anyone going against these rules will be expelled from the CTF, along with their entire team
CTF Registration Rules
- Be sure to read all the information when you register with Eventbrite
- A valid email address must be provided when registering
- An account on the Hackfest Discord is required
- Teams can be made up of a maximum of 6 people (we will mix teams that are not complete)
- Stay tuned to the
HFCTF 2026 category on our Discord.
Logistics for artificial intelligence
- There will officially be two separate scoreboards: one where AI tools and agents are allowed, and one where AI is prohibited. A detailed description of what is and isn’t allowed will be available during the competition.
- Registration will follow the same procedure as for past CTF Casual and Pro events. There is no difference in the registration fee, and it will not be possible to change categories once you have registered. Both CTFs will take place simultaneously in the same room and are considered “first-class citizens”.
- The no-AI CTF network will be monitored, and our team of designers will request varying levels of explanation for questionable solutions. If we believe cheating has occurred, points will be deducted.
- The same challenges will be featured in both CTFs. However, our designers have the freedom to include a few additional traps in the AI CTF.
- The points on both scoreboards will be essentially the same, except that the AI CTF score will be dynamic, which means the value of a flag will be reduced each time it is submitted.
- There will be no cash prizes in either CTF, and the final results will not be posted on CTFTime. Prizes will consist of coins, goodies, swag, and, of course, the eternal glory that comes with victory. This will also allow us to award additional random participation prizes.
Rules for artificial intelligence
- It is FORBIDDEN to give artifacts of challenge to any AI tooling. This includes, but is not limited to, challenge descriptions from CTFd, downloaded assets, web page content, etc.
- It is FORBIDDEN to have an agent directly interact with a challenge. For example, you cannot have an agent attack network ports, run scripts against a target, or dynamically adjust code based on a server behavior.
- It is FORBIDDEN to use AI to interact with the scoreboard (CTFd), the provisioning platform or any part of the CTF infrastructure in any circumstances. This includes, but is not limited to, submitting flags, accessing challenges descriptions and assets, tracking the leaderboard, spawning challenges, etc.
- Tools that are not AI agents per se, but use agentic capabilities or LLMs are subject to the above rules.
- It is ALLOWED to ask questions to an LLM, just as it is allowed to use a search engine to find the information yourself.
- It is ALLOWED to have AI agents generate code, as long as it complies with the above rules.
- There is no restriction on which models can be used, as long as it is within the above rules.
- At any time, the challenge designer team can ask you for explanations about your flag submissions or challenge progress, either in person or through Discord. The requested information cannot be generated using AI tooling. Until the requested information is provided, associated points might be temporarily removed. In the rare event that this happens very close to the end of the CTF, additional time will be given to provide the requested information. If the explanation is deemed unsatisfactory, points will be permanently removed. Keep in mind that the explanation provided is only one of the indicators that will be used to determine if the solve is valid (e.g. network monitoring, CTFd log analysis, solve times, etc.). Also, beware of social engineering. If explanations are asked through Discord, ensure that the user has the @Ninja or @Ninja-Padawan role. If explanations are asked in person and you don’t recall seeing that person at the admin table, tell them that you are going to go see them at the admin table shortly.
Required Equipment
- A PC/laptop and any peripheral you deem necessary
- What you need to connect to the CTF Wi-Fi network (if your computer does not already have a built-in Wi-Fi card)
