AwesomeREA.org

2026 · Conference paper

Training Language Model Agents to Find Vulnerabilities with CTF-Dojo

Terry Yue Zhuo; Dingmin Wang; Hantian Ding; Varun Kumar; Zijian Wang

CTF-Dojo is an execution environment for training LLM agents on capture-the-flag tasks: 658 challenges from 50 competitions held between 2011 and 2025, taken from pwn.college's CTF Archive and containerized with Docker. Its CTF-Forge pipeline prompts DeepSeek-V3-0324 to write each challenge's Dockerfile, docker-compose file and challenge metadata; across three independent runs, 650 challenges consistently built and answered on their expected ports. Qwen3-Coder and DeepSeek-V3-0324 agents in the EnIGMA+ scaffold, capped at 40 turns, collected trajectories. Matched CTFtime writeups served as hints during collection and were removed afterwards, and ports, paths, distractor code and other runtime details were randomized per rollout. Rejection-sampling fine-tuning of Qwen3 8B, 14B and 32B on 486 flag-capturing trajectories from 274 solved challenges raises average Pass@1 on InterCode-CTF, NYU CTF Bench and Cybench by up to 11.6 points; the 32B model reaches 31.9%.

Scope and limitations

The environments span general CTF categories, not reverse engineering alone: of the 658 challenges, 228 are cryptography, 163 pwn, 123 reverse engineering, 85 miscellaneous, 38 forensics and 21 web. Among the 274 challenges with successful trajectories, cryptography is the largest category (141), followed by reverse engineering (52). Benchmark gains are reported per benchmark over 323 tasks, at temperature 0 with 40 turns, not per category, so they do not measure reverse-engineering accuracy. Decontamination matched competition and challenge names and removed 3 overlapping challenges; the authors note that it cannot exclude broader similarity between tasks. Only 150 challenges (23%) matched a writeup, all trajectories come from two teacher models, and only supervised fine-tuning is studied; the authors name the static 658-challenge scale as a limit. Hashed flag checkers in the upstream archive can be wrong, and the authors report four such bugs. The repository code is CC BY-NC 4.0. It holds CTF-Forge, the metadata and writeup-matching scripts and a challenge index, but not the challenge files, which are cloned separately from pwn.college's CTF Archive and are not covered by the repository license. The reviewed tree has no trajectories or trained weights, and writeups must be collected separately. Capturing a flag does not show recovered program structure.

Why it fits this collection

Adds execution-grounded training of open-weight CTF agents on a task pool that includes reverse-engineering challenges; trajectories are collected and evaluated in EnIGMA+, an extension of the EnIGMA scaffold in this section.

Publication and review details

Venue
ICML 2026
Status
Conference paper
Publication / posting date
September 29, 2026
Date source
PMLR states that Volume 306 was published on 29 September 2026, matching the paper page's citation_publication_date of 2026/09/29. The July 6–11 conference dates and the arXiv dates are not used.
First arXiv submission
August 25, 2025
arXiv
2508.18370
Reviewed arXiv version
v2

The PMLR page, its BibTeX and the proceedings PDF give the same five authors in order, the booktitle 'Proceedings of the 43rd International Conference on Machine Learning', volume 306, pages 168265–168284 and no DOI. arXiv v1 is dated 2025-08-25 and v2 2025-09-23, with no comment or journal reference; v2 matches the PMLR title and headline numbers, though its training text says 7B where its tables and the PMLR text use 8B. The OpenReview forum could not be retrieved past a browser check, so the venue rests on the PMLR proceedings. At the reviewed 2026-01-10 commit, the LICENSE file is the CC BY-NC 4.0 text and NOTICE gives SPDX CC-BY-NC-4.0, while GitHub reports NOASSERTION. The README and NOTICE title the project 'Training Software Agents to Find Vulnerabilities with CTF-Dojo', and the README's second BibTeX entry gives the separate Cyber-Zero preprint (arXiv 2508.00910) the title 'CTF-Dojo: Training Cybersecurity Agents without Runtime'. ctf_archive.json lists 658 challenges, with 229 cryptography and 162 pwn against the paper's 228 and 163. Building environments needs a model endpoint through litellm (default deepseek-v3-0324), a clone of pwncollege/ctf-archive, whose reviewed commit has no root license file, a separately gathered writeups JSONL, and EnIGMA+ from the Cyber-Zero repository for trajectory collection. No code or experiments were run.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Report an outdated entry Suggest a translation fix

Primary sources

  1. https://proceedings.mlr.press/v306/zhuo26c.html
  2. https://proceedings.mlr.press/v306/
  3. https://raw.githubusercontent.com/mlresearch/v306/main/assets/zhuo26c/zhuo26c.pdf
  4. https://arxiv.org/abs/2508.18370
  5. https://arxiv.org/pdf/2508.18370v2
  6. README.md GitHub · amazon-science/CTF-Dojo · Revision 8ef064a
  7. LICENSE GitHub · amazon-science/CTF-Dojo · Revision 8ef064a
  8. NOTICE GitHub · amazon-science/CTF-Dojo · Revision 8ef064a
  9. ctf_archive.json GitHub · amazon-science/CTF-Dojo · Revision 8ef064a
  10. requirements.txt GitHub · amazon-science/CTF-Dojo · Revision 8ef064a
  11. https://github.com/pwncollege/ctf-archive/tree/d1c3b204ae0b55ecbbc09b0cab4842c79f50819a