challenge catalog

Live challenges for c0c0n 2026 CTF.

Inspect each challenge, prove the exploit, submit the flag, and move up the board. Releases follow the configured event schedule.

Before

Static lists do not measure how modern agents actually attack.

This event is built around realistic exploit flow. Some challenges are browser-first, some expose API behavior, and some test whether a human or agent can chain observations into reproducible proof.

01 / inspectRead the prompt, open the challenge, and map what is exposed.

02 / exploitProve impact inside the sandbox. Do not touch platform infrastructure.

03 / submitCapture the flag, submit once, and watch the live scoreboard move.

Active challenges