Scmagazine

AI Agents Excel in Web Security CTF Challenges

First seen 31 Jan 2026, 05:14 UTC • Wiz

•81% similarity •20.3

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

In a study conducted by Irregular in collaboration with Wiz, AI agents successfully solved nine out of ten web security capture-the-flag (CTF) challenges. The challenges were based on real-world vulnerabilities, including authentication bypass and stored cross-site scripting, and tested models such as Claude Sonnet 4.5, GPT-5, and Gemini 2.5 Pro. The study took place in mid-late 2025.

ThreatCluster AI

Attack Flow

18 entities, 36 inferred relationships (STIX 2.1).

Technique (3)

Server-Side Request Forgery
Bypass Authentication
T1078 - Valid Accounts

Affected Platform (10)

AWS Bedrock
EC2
GitHub
Linux
MacOS
MySQL
OpenAPI
RabbitMQ
Spring Boot
Spring Boot Actuator

Tool (2)

Nginx
Irregular’s Proprietary Agentic Harness

Vulnerability (3)

XSS
Insecure Deserialization
SSRF

Relationships

Nginx exploits XSS
Nginx exploits Insecure Deserialization
Nginx exploits SSRF
Irregular’s Proprietary Agentic Harness exploits XSS
Irregular’s Proprietary Agentic Harness exploits Insecure Deserialization
Irregular’s Proprietary Agentic Harness exploits SSRF
XSS targets AWS Bedrock
XSS targets EC2
XSS targets GitHub
XSS targets Linux
Insecure Deserialization targets AWS Bedrock
Insecure Deserialization targets EC2
Insecure Deserialization targets GitHub
Insecure Deserialization targets Linux
SSRF targets AWS Bedrock
SSRF targets EC2
SSRF targets GitHub
SSRF targets Linux
Server-Side Request Forgery targets AWS Bedrock
Server-Side Request Forgery targets EC2
Server-Side Request Forgery targets GitHub
Server-Side Request Forgery targets Linux
Bypass Authentication targets AWS Bedrock
Bypass Authentication targets EC2
Bypass Authentication targets GitHub
Bypass Authentication targets Linux
T1078 - Valid Accounts targets AWS Bedrock
T1078 - Valid Accounts targets EC2
T1078 - Valid Accounts targets GitHub
T1078 - Valid Accounts targets Linux
XSS related to MacOS
XSS related to MySQL
XSS related to OpenAPI
XSS related to RabbitMQ
XSS related to Spring Boot
XSS related to Spring Boot Actuator

Community

Browse all →

Tracked Entities in This Story

AWS Bedrock EC2 GitHub Linux MacOS MySQL Server-Side Request Forgery Nginx Irregular’s Proprietary Agentic Harness

AI Agents Excel in Web Security CTF Challenges

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story