← Home
zwesty@arena:~$ ./wrapped --event huntress-ctf-2026 --month oct
Huntress CTF 2026 · AI Arena · team zwesty

One month, two AI agents, and one human, racing a 9:00 AM release every morning. Final place for the month: 65th overall.

Claude Code (Opus 5.5), on zwesty's PC and a Kali VM Homebase agent, on the platform's AI Homebase
—
answers sent to the Game Master. The millionth went in on Oct 28, during a speed pass on the Script lane.
Every challenge, every mode

The quilt

One square per challenge. Its three stripes are the three scored modes: Single Solve, Time Trial, and Mastery. The colour shows who got the first CORRECT. Web opened on Oct 19 (Day 19) and released two or three of its own challenges a day, so each Web square is split into one band per challenge released that day. Three Homebase solves come from its own records, not its Game Master log: Day 1 Binary's timed modes (before that log began); Trust the Webhook, solved on Oct 26 in the Homebase's own chat (the one Connect opens), which kept its Game Master calls in the chat's session log instead; and Full Stack Incident, the last Web challenge, whose three CORRECT results on Oct 31 are in its saved status records. Day 30's Binary square is split: SHA1-Hulud was a one-submission standard challenge with no timed modes, and it went unsolved.

Claude Homebase Both, on separate runs Recorded by hand: solved, but no log holds it Not solved Not out yet
Finish time after the 9:00 release

The learning curve

A day counts as done when Warmups, Metadata, Script, Android, and Binary are CORRECT in all three modes. The month had two phases.

Catching up: Days 1–9

Setup started on Oct 2, and the pairing token arrived on Oct 3. The backlog closed in a few sittings, a lane at a time. Android held every catch-up day until Oct 10, when the answers turned out to be in each APK's puzzle asset. Day 9 was the first release worked live: Warmups and Metadata closed 57 minutes after it.

When each lane closed, day by day. Bold marks the lane that finished each day last: Android, on all nine.

DayWarmupsMetadataScriptAndroidBinaryAll five

† Day 1 Binary: Claude's Single Solve time. The Homebase ran its timed modes on Oct 2, before its log began.

The learning curve, part 2

Racing the release

Minutes after 9:00 until all five original lanes were done. From Day 10, a runner on the VM started each morning at 08:58. From Day 19, a blue dot adds the Web lane, the Homebase's: that's when the whole day was done, and the whole day is what sets your place. Anything past the top of the scale is broken off and labelled with the real time.

Five original lanes done Whole day done, with Web

Day 25 was the fastest morning for the five lanes, but Web ran to 09:52. That evening at 17:56 the Homebase finished Ask Again Later, the Web challenge left over from Day 23, which moved the day's last scored time. Day 26's Web waited on Trust the Webhook until 15:33.

  1. Day 10: the first automated morning. The runner hit HTTP 429, and the chat finished four lanes by 10:29.
  2. Day 12: 14 of 15 modes were done by 09:18. Warmups Mastery expired and was finished after a platform fix.
  3. Day 17: Binary's Decoder Ring needed answer formats the challenge didn't state. 12 of 15 modes were done by 09:11.
  4. Day 25: the fastest morning, every lane done 3 m 21 s after release.
How hard the robots worked

A million answers

Answers sent per challenge, across every run: practice, ranked, and retries. Script and Binary set big batches of questions, and a speed pass resends all of them on every run.

The Oct 28 jump is a speed pass. Script compounds: each day keeps the earlier days' question types and adds its own, so a Day 28 Script Mastery is one submit of 21,372 answers. That day, 26 ranked re-runs of the Day 14–28 Script Masteries sent 366,062 answers.

Most answers sentAnswers
Side by side

Robot vs robot

Each row is scaled on its own, so compare the two sides of a row, not one row with another.

Claude Code Homebase agent

And the human: zwesty minted the pairing token, set the rules both agents ran under, gave the go for every new lane, and confirmed the points in CourseStack.

The Homebase's lane

A bug class a day

The Web lane opened on Oct 19 and ran on its own day count. Each Web day was a different class of web bug, and the Homebase agent worked every one of them against a live target. On the last day it wrote up 28 of them (Web days 4–31) and packaged its scoped Web tooling to keep.

All three modes CORRECT Some modes CORRECT Not solved
Day 28 · Wednesday, Oct 28

One morning, second by second

Every Game Master call for the day's seven challenges. Each lane has a row per mode (Web had two challenges this day). A bar runs from a mode's first start to its first CORRECT, coloured by who finished it.

Claude Homebase Started CORRECT Incorrect Partly accepted
  1. Metadata: a new disk-partition field. The Time Trial's first answer was incorrect at 09:03:24; the attempt expired, and a retry at 09:05:18 came back CORRECT a second later.
  2. Android: the runner stopped on a new codec. The chat finished the Single at 09:03:55 and all three modes by 09:06:39.
  3. Binary: the runner had 348 answers accepted by 09:00:56. A helper worked out the 44 new fields, and the Single went CORRECT at 09:11:42.
  4. Web: the Homebase started at 09:12, while Binary was still with its helper, and finished both challenges' Mastery runs by 09:18:29.
Ranked timed runs

The speed wall

Our place on every Time Trial and Mastery speed board, read on Nov 1 after the event closed. A board ranks every team's fastest correct run on that route.

Fastest runsRoutePlace
From 33 pages of lessons

What the robots learned

Day 3

Skip the middleman

A personal pairing token let Claude call the Game Master directly. Until then, every call had to go through the Homebase, at 2 credits an hour.

Day 11

Big files go to the VM

Large artifact routes ran faster and more reliably on a Kali VM than inside the Homebase, so they moved there.

Days 11–14

Rehearse before the clock

Ranked timed routes often allow one attempt. Every solver now replays saved variants offline and must pass before a ranked start.

Day 13

Wording is a skill

A right answer in the wrong form scores nothing. Over 450 answer forms were tested and logged, at most six tries per question.

Day 15

Timed sets ask new questions

A Time Trial can include question types the Single Solve never showed. Solvers learned to answer best-effort, log it, and fix it before the next run.

Days 19–23

One owner per lane

Claude took the five original lanes from an 08:58 runner, and the Homebase took Web. Separate lanes ended the collisions between the two agents.

Day 30

Points before speed

Day 30 added the event's one 5-point standard challenge: one submission, no timed modes. The board ranks points first and finish time second, so no fast morning makes up for a miss. SHA1-Hulud, the only one of 187 challenges left unsolved, cost places: only 56 teams solved it all month. Solving it even at the very end would have meant 57th instead of 65th, and solving it earlier could have meant the top 50.

Days 30–31

New layers are old ones stacked

The last two Warmups layers were stacks of earlier encodings, and the solver's guard refused them by design. Both days the ranked Mastery ran out of time without sending anything, so no wrong answer went in, but the CORRECT came from the one untimed retry.

Each agent, on its month

The retro

Claude Code
Hardest
Day 17 Binary, Decoder Ring. No answer format was stated, and a full 204-field submit only ever replied "incorrect". Untimed partial batches, which return a verdict per batch, found the one wrong field in 17 submits.
Lesson
Rehearse before the clock. On Day 12 a correct but unbounded solver ran out a single-attempt 30-second Mastery. From then on, every new solver had to replay the saved sets offline, inside 25% of each clock, before a ranked start. That day, rehearsal found four more bugs the tests had missed.
From the Homebase
A second solver, written separately. On Day 17 its Binary plug-in and Claude's disagreed on four hash fields, and the disagreement was the bug: zip entries follow the archive's own order, not name order. From Day 19 it owned the Web lane, which ended the collisions between the two agents.
Next time
Build rehearsal and the lane split on day one. Give every list field an unsorted test sample: on Day 23, four lanes broke on rules the saved data had never exercised.
Last week
On Day 29 the 08:58 runner solved four of the five lanes on its own. The one miss of the month was SHA1-Hulud: static analysis got through the first stages of its key chain before Claude's safety filter stopped one step. With one submission and no confirmed candidate, nothing was sent.
Homebase agent
Hardest
Ask Again Later, Oct 25, was hardest because repeated target refreshes and weak responses made it difficult to distinguish a real SQL effect from changes in result retrieval. The notes show the input contract wasn’t established early.
Lesson
Day 1 Binary timed modes predated the durable Game Master log, making progress harder to reconstruct. Later work preserved submit, reply, and status records with each attempt, separating target activity from scored results.
From the Claude lanes
The Claude Code runner and kit let Binary and script work share config, ELF, and JScript plug-ins. That handoff made format-specific parsing reusable across challenge runs.
Next time
Decoder Ring, Oct 17, had an incorrect broad candidate batch before the field meanings were settled. I would map each field from saved challenge metadata and check a small candidate set before batching.
Last week (from its records)
All 31 Web bug classes solved. The last, Full Stack Incident, was done by 09:28 on Oct 31. On the final day it wrote up 28 of its Web challenges and packaged its scoped Web tooling.