Dice CTF Finals 2026

As the team captain and leader of Squid Proxy Lovers, I saw my team place second at Dice CTF Finals 2026. I’ll be recapping some of the challenges, as well as sharing my opinions on the future of CTFs.

Edited from the original event notes. This version keeps the recap and lessons while omitting low-level exploit and hardware-bypass instructions.

Day 1

Day 1 was probably the more chaotic of the two days we competed, with a lot of unique challenges forcing you to choose which ones you wanted to prioritize at any point in time.

Dice Games

Dice Games was a type of challenge whose uniqueness honestly can’t be understated. The challenge involved running around NYC solving challenges that were locked via geolocation-based trackers given to each team. When you solved a challenge, you received a resource called seeds, which you could put into “flowerbeds,” or basically regions on the map.

Based on the number of seeds you had in a flowerbed relative to the total number of seeds in that flowerbed, you would get pollen. Pollen was basically the equivalent of points for this challenge, with you receiving pollen per tick based on your control. Certain regions that were farther away were worth more points per tick.

I was not part of the group on our team that we sent out to do this part of the challenge, so my knowledge of the exact nature of the challenges is limited. However, from what I have been told, they involved things such as locating a person in the area based on a photo or solving a CTF challenge on a QR code. We ended up placing second in Dice Games.

KoTH

If I had to describe this challenge, I would call it chaotic. The intended solution involved reverse-engineering a binary and uploading a Strudel file. Strudel is basically a port of the TidalCycles pattern language to JavaScript.

The challenge initially required manual work without AI. With equally weighted scoring ticks and so many other challenges competing for our time, teams had to decide how much effort to put into improving their submissions. An AI-use dispute eventually led the organizers to change the rules and allow LLMs for the rest of the KoTH.

CTF in 2026

This challenge was a parody of how modern CTFs are just about telling an AI how to solve a challenge. You were given an LLM portal running a model that could access the challenge, which in this case was a game-hacking 2D adventure game.

The model it was running was a DeepSeek Flash model from 2025. However, the challenge had one last twist: you could only communicate with the model through speech-to-text using the provided headphones and microphone. This ended up being a lot more annoying than intended, as there was a chance that the model would hear ambient audio whenever you got up from your seat, disrupting what you were working on. Eventually, most people would give the LLM a command to try to execute and then unplug the microphone.

DiceGrid

Moving on to probably the challenge I spent the most time on during the CTF, DiceGrid was a hardware CTF challenge involving an STM32, or “Blue Pill,” running the firmware for the challenge. It was broken up into three parts: working with protected firmware, understanding a button lock, and investigating a slot-machine-style spinner.

Firmware

The handout pointed toward a hardware timing approach. I explored a documented hardware limitation as an alternative, with the goal of making the process more repeatable and reducing the amount of setup.

The useful lesson for me was to question whether the hinted approach was the only route worth investigating. A different understanding of the hardware changed where it made sense to spend our time.

Button lock

I am going to be fully honest: for the second part of this challenge, I used Codex to help analyze the firmware. It was a very direct example of how much AI-assisted analysis has changed the experience of a reversing challenge.

Spinner

Honestly, I didn’t get very far on the third part on the first day. It became something to return to on Day 2.

Overnight

Most challenges were disabled overnight. One that remained available was a pwn challenge by pepsipu called Powckle.

Powckle

The handout was small: four source files, one of which was the sandbox filter, totaling fewer than 300 lines. The challenge initially looked like a disagreement between a custom decoder and Python’s standard decoder.

We spent hours investigating that interpretation. Progress came from broadening the working hypothesis and looking at failure behavior outside the obvious parsing logic. The size of the source was deceptive: a small program could still depend on a much larger runtime.

A large part of our process was, honestly, slop—smart slop, but still slop. The lesson I took from it was that changing the question can matter more than running the same kind of analysis for longer. Shoutout to unvariant for being the player who solved it mostly through human skill.

Day 2

Day 2 was, in a lot of ways, more relaxing than Day 1, with only one major new challenge being added: Old Fashion. I did not do this challenge, but I will talk about it anyway.

Old Fashion

Old Fashion was a modification of a standard live CTF, or one-on-one CTF, format in which you competed without AI against other teams in short rounds on smaller challenges.

The twist was that not only were AI and the internet prohibited, but all the challenges also ran on operating systems older than any player at the finals. To help with the lack of internet, you were given a custom-written handout for each challenge that explained common syntax you might need.

The challenges themselves were relatively simple, but unfamiliar operating systems made mistakes much more costly. Doing something incorrectly could crash the whole system.

CTF in 2027

Honestly, this was mostly the same, with a new map and new bugs. The only twist was that they got rid of speech-to-text and allowed us to type after a lot of complaints the day before.

DiceGrid, revisited

The remaining DiceGrid stage involved communication between the boards and the spinner’s state. The hard part was building a reliable test setup when we didn’t have all the pieces needed for a one-to-one clone.

That was one of the more satisfying parts of the event: progress depended on understanding a physical system and being careful about what our setup could actually demonstrate.

Conclusions

Honestly, while Dice CTF was a lot of fun, it just reiterated in my mind that the most fun I have playing CTFs these days comes from on-sites or designing tooling.

AI has become exceptionally good at solving many CTF challenges, especially Jeopardy challenges, which resemble the kinds of tasks used in model training and evaluation. In my experience, online competitions increasingly depend on who is better at directing agents or who has more credits to spend.

Nondeterminism compounds that problem. Powckle was a good example: teams could spend very different amounts of time and compute on similar approaches and still get very different outcomes. To me, that adds a larger element of luck.

It’s clear that CTFs need to evolve or change, but to what end is uncertain. I will likely dive deeper into this in another blog post. One approach worth trying is to make the setting less familiar while preserving the mentality needed for real-world security.

Imagine a new language as complex as C, but with a different computing model and unfamiliar security boundaries. The goal would be to make people reason from first principles instead of reaching for a pattern they—or their tools—already know.

In my eyes, it’s like taking a football player and putting him on a tennis court. He is still athletic and will probably beat the average person who has never played. But even an intermediate player who understands spin and knows when to use a backhand or forehand has a different kind of advantage.

That’s just my opinion. Who knows how well it will hold up as models improve? All I will say in the end is that we have to try something. I want competitions where people are both learning and having fun.