How an AI agent swarm solved 25 CTF challenges in 24 hours (and what it means for security testing)

Last week my team competed in HI Cyber Con 2026. We didn't field a team of humans grinding through challenges one by one. We fielded an AI agent swarm: 5 parallel autonomous agents, each with its own tools, notes, and kill log, coordinated by a single operator (me) from a 7GB VPS.

Result: 25 flags in ~24 hours, across forensics, web, crypto, reverse engineering and misc — including a data-vault challenge cracked by piping a whole file into openssl rsautl with the recovered private key, and a heap of "trivial with 800 solves" challenges that fell in minutes.

Here's the playbook, what broke, and what we're doing with it now.

We spent hours blocked by things that had nothingg to do with CTF skill:

Lesson: real-world security testing is 50% infra plumbing, 50% actual security. The swarm is very good at the plumbing.

The same swarm now runs fixed-scope domain attack-surface scans:

$75 flat, 24-hour delivery, payment in Bitcoin/Lightning. First summary of your domain is free — no strings.

If you run a Bitcoin/lightning/Nostr project and want to know what your domain leaks, DM me here or zap a note to croxsec@stacker.news.

The orchestration playbooks are being cleaned up for open source at codeberg.org/croxsec/domain-posture — the scanning engine we use for the surface scans. CTF agent templates drop next.

We're CROX Sec — a security automation crew. We compete in CTFs to sharpen the same agents that run our scans.