In 2025 I took second place in Cyberlandslaget, Norway’s national cyber championship. A younger me would have printed the scoreboard and framed it. Instead it felt like placing second in a chess tournament the same week everyone else discovered Stockfish. I finished the event, closed the tab, and understood that I was done with CTFs.
This is the long version of why. The short version, and the results I’m still proud of, live on the CTF archive page.
What the game actually was#
If you’ve never played: a CTF (Capture the Flag) is a hacking competition made of puzzles. Someone hides a string, the “flag”, behind a broken cipher, a vulnerable web app, a weird binary, an audio file full of beeps. Your job is to get it out. That’s the whole sport.
On paper I was collecting points. In practice I was buying a very specific feeling: the click. The moment a system stops being a wall of noise and becomes a mechanism you understand. My whole approach to life is built around chasing that moment, and CTFs sold it in concentrated, evening-sized doses, guaranteed to contain at least one trick.
I was decent, too. Two solo podium finishes in the Novacare events. A perfect 41/41 in HelseCTF. And one solve I will stay smug about forever: a challenge dropped at exactly 00:00 and I submitted the flag 50.3 seconds later, because I recognize DTMF beeps the way some people recognize a song from the first chord. My team, Ådne’s Boys, was me and two friends being nerds on weekends. It was the best kind of pointless.
Then the game changed#
Somewhere along the way, the answers started arriving faster than the understanding. Not mine. Everyone’s.
Language models got good at exactly the shape of thing CTFs are made of: self-contained puzzles with a known answer format, built on tricks that have appeared, in some variation, a thousand times on the public internet. That is not an insult to the puzzles. It’s just what they are. The property that made them perfect training also made them perfect prompts.
I tested it myself, because of course I did. Challenges I would have happily chewed on for a whole evening came back solved in the time it takes to paste. I expected to be impressed. Mostly I was just tired.
A leaderboard only means something while everyone is playing the same game. Once a model can one-shot half the board, the ranking stops measuring curiosity, stubbornness, and pattern memory, and starts measuring who has the best model access and the fastest paste hand. Organizers write rules against it. Enforcement is an honor system. The honor system lost.
Novel pwn and reversing with weird constraints still resist. Anything physical resists. But the middle of the difficulty curve, where most of the fun lived for most of us, is exactly where the models are strongest.
Sour grapes, examined#
The obvious objection: just use the tools. Bring the model, prompt well, compete in the new game. I work in security. I use these things every single day at my actual job. Nobody has banned me from the future.
But the grind was the product. I wrote in the PPAP post that the compound makes effort itself feel good, and that it amplifies nothing unless there’s real interest underneath. CTFs were the drug-free version of that exact loop: effort in, click out. Delegating the effort and keeping the points is like paying someone to lift weights for me. The numbers go up. I get nothing.
So no, it’s not that I can’t keep up. It’s that “keeping up” now means becoming the manager of a thing that has the fun on my behalf. I already have a job.
The bigger version of this feeling#
A few days ago I wrote, in a moment of honesty: call me a conspiracy theorist, but I see no future for me here. AI is becoming too powerful, and I don’t want to become a “Prompt Cyber Engineer”.
That thought is bigger than CTFs, and I won’t pretend a blog post resolves it. I already wrote a whole essay about AI as a present-tense force, and nothing in it has gotten less true since. The hobby was simply the first place the water came over the wall, because hobbies are optional and rent is not. Defensive security still needs human hands and human judgment, mine included, for now. I notice that I’m the one who keeps saying “for now”.
What survives#
The archive stays up. I’m proud of it the way you’re proud of a sport you’ve retired from: the results don’t stop being real just because the league changed.
The mindset survives too. Everything can be broken, it turns out, including the game itself. That’s grimly funny if you squint.
My evenings go elsewhere now: a chemistry course at UiT, a nutrition database nobody asked for, and self-experiments where the rate limiter is my own biology. AI can have the flags. It can’t sit my stoichiometry exam yet, and it definitely can’t do my bloodwork.
And if some CTF figures out how to make the game about understanding again, with the models either fully in or fully out, I’ll probably show up anyway. Retired athletes always say that.
/Henrik
