Designing a Capture The Flag challenge in the era of AI-augmented security
How LLMs have fundamentally changed the security landscape
Andrew MacPherson
|Jul 13, 2026
At Privy, all engineering is security engineering. The Deep End is our experiment in AI-assisted security. We set out to build a CTF that could withstand LLM might. The result is the Deep End, an unusual set of puzzles to reward curiosity, exploration, and technical skill.
Climb the leaderboard and compete for prizes with a total value of up to $10,000. See Terms & Conditions.
About the Deep End
Do humans still matter in security?
At Privy, we build secure, scalable wallet infrastructure powering millions of accounts. As we do this, security isn't a function, it's core to how we build. The Deep End started with a simple premise that reflects how much the threat landscape in security is changing: how do you build a great CTF in 2026, when frontier models can brute force most problems? The Deep End is our attempt to craft challenges that are both fun for humans and genuinely awkward for frontier models.
We wanted to poke at a real question in AI-assisted security: how much do humans still matter in security work? Models are becoming very good at just-in-time intelligence. They can explain unfamiliar code, help build harnesses, reason through weird bugs, and give anyone a path into work that used to require years of narrow context. This is really exciting but it also means old instincts about what is hard for automation keep expiring.
How to build a CTF in 2026.
Our first iteration was a direct CTF. But a lot of modern CTFs are easy to turn into model food. Paste the source, paste the prompt, paste a screenshot, ask what you are missing, burn some tokens, repeat. That can be a useful exercise, and anyone doing security work should probably be getting good at that workflow, but it also changes the feeling of a puzzle. The CTF just isn’t that much fun anymore.
Take 2. We set out to build something that required more than just a clean transcript for an LLM to solve. Messy browser state. Visual noise and other nonsense. Tiny clues you forget until they become annoying. Pages that reward clicking around and keeping notes. A strange phrase that you had to remember, so when you go back and test a bad theory, you realize the thing that felt suspicious actually mattered.
But the models got rude.
They opened browsers, dragged pieces into place, generated images, and solved puzzles we had convinced ourselves would still need a person.
Onto stage 3: the project changed shape. The goal stopped being a clean human victory over agents and became something more honest: let’s ship a weird CTF, throw people in the deep end, and let them bring whatever tools they want, and see what happens when the page, the story, the state, and the puzzle mechanics all push back at once.
Diving in the deep end
We’re proud to present The Deep End. We bring together submarine systems, broken signals, market records, odd machinery, suspicious UI, and staged challenge chains that reward attention. Bring notes. Bring tools. Bring an LLM if you want. Tell us what helped, what failed, what felt unfair, and what solved something it had no business solving.
Anyone working in security knows we are living through a pivotal time. Old assumptions are broken and we must rethink how to consider system security in a world where intelligence runs on tap. Building a CTF in 2026 is a humbling experience but we shipped the Deep End because the experiment still felt worth sharing. Our original assumption (that we could make an agent-proof CTF) is broken, but the process taught us something useful about where security work is going, and we got a CTF that still feels fun to play.
Join Privy
The Deep End is a side quest but speaks to our core work securing wallet infrastructure for the next generation of global financial products. From embedded wallets to programmable controls and digital asset flows, we help developers build secure experiences at scale.
Come build
If you obsess over threat models, attacker power and offensive security you'll probably enjoy the shape of engineering at Privy. We care about pragmatic security, clear threat models, and building systems people can depend on. We value curiosity, thoughtful engineering, and people who chase interesting questions long enough to turn them into useful ideas.
