HACKERS CHALLENGE SAINTCON Spaceways · Flight 26 Registration opens soon

Standing orders · 2026

Rules & Format

The complete rules for the SAINTCON 26 Hackers Challenge — stages, scoreboards, AI self-identification, how the five final seats are filled, and what gets you disqualified.

Philosophy

The Hackers Challenge is run education first, competition second. AI tools have become good enough to one-shot many CTF challenges, and AI use cannot be fairly policed across a large online field. Rather than ban or detect AI, we ask players to self-identify their tool use, and we make the decisive round — the in-person final — AI-free for everyone.

Stages

Stage 1

Online qualifier

A Jeopardy-style board of challenges grouped by category. Solve a challenge, submit its flag, earn points. Dynamic scoring: challenges start at 1000 points and decay as more players solve them (HC_scoring); some challenges are static. The qualifier closes Friday 6:00 AM.

Stage 2

In-person final

Friday 8:30–10:30 AM. Proctored, up to 5 contestants (4 merit seats + up to 1 reserved minimal-AI seat), all challenges worth the same. AI is prohibited during the final (ChatGPT, Claude, agents, and similar). The overall winner — the Black Badge — is decided here.

Scoreboards

Three public boards, visible throughout — we do not hide the scoreboard:

  • Combined

    Everyone.

  • Minimal-AI

    Players who self-identified as minimal-AI.

  • Maxi-AI

    Players who self-identified as fully AI-assisted.

AI self-identification

At registration, each player declares minimal-AI or maxi-AI. This is on the honor system and is not policed across the field — it only carries weight for the one reserved final seat, where the claim is backed by a solve writeup.

Minimal‑AI

You solved the challenges under your own power. You may use search engines, documentation, past writeups, and standard tools, and you may ask an AI assistant to explain a general concept. But AI did not analyze a specific challenge for you, write your exploit or solution code, or produce a flag. The analysis, the insight, and the exploit were yours.

Maxi‑AI

Any use of AI, LLMs, or agents to help you solve: analyzing a challenge, reasoning through it, generating exploit or solution code, autonomous agent solving, or AI coding assistants leaned on for your solution.

When in doubt, declare maxi-AI. Declaring minimal-AI is a claim you may have to back with a writeup, and nothing is lost by declaring maxi — only the reserved final seat depends on the minimal declaration. Incidental AI you didn't lean on (e.g. an autocomplete suggestion) isn't disqualifying by itself; relying on AI to solve is.

This restricts tool use, not collaboration. Working with, hinting to, or social-engineering other players is allowed for everyone (see Ethics) and does not affect your minimal-AI status.

Advancement to the final (4–5 seats)

  • 4 seats
    Merit, category-blind. The top 4 on the combined qualifier board, whatever their self-identified track. Standard tie-break favors the earlier solver.
  • 1 seat
    Reserved minimal-AI, verified by writeup. Filled from the reserved-seat pool via the writeup process below.

Overlap rule. The 4 merit seats are pulled first. The reserved-seat pool is then the 5 highest minimal-AI players who are not already holding a merit seat. If a minimal-AI player is in the combined top 4, they take the merit seat and the next-highest minimal player is pulled up to keep the pool 5 deep. No one takes two seats, and the 5th seat is strictly a minimal-AI seat.

Reserved-seat writeup process

  1. Thursday evening: all minimal-AI players are notified (via CTFd) which challenges will require writeups, so anyone in contention can prepare overnight — before they know their final rank.
  2. Friday 6:00 AM: the qualifier closes; the minimal-AI board is final and the top 5 are known.
  3. Friday 6:30 AM: writeups due. Any of the reserved-seat pool (the 5 highest minimal-AI players not already in a merit seat) who want the seat submit writeups for the announced challenges. Writeups are prepared overnight; the 30-minute window is just for submitting.
  4. Friday 7:00 AM: HC staff review in board order and walk down the pool until the first acceptable candidate — that player takes the reserved seat. Selection complete.
  5. Floor: if none of the pool submit an acceptable writeup (or all decline), the reserved seat stays empty and the final runs with the 4 merit players. The seat is never backfilled from the combined or maxi board — it belongs to the minimal track, earned or vacant.

Writeup judging criteria

A writeup is acceptable if it demonstrates the player's own solving process — the reasoning, dead ends, and steps that led to the flag — at a level consistent with having solved it themselves. It is not a style contest; it is evidence of authorship. Missing writeups, or writeups that only restate the challenge or paste output without process, are not acceptable.

Friday timeline

TimeEvent
Thursday eveningMinimal-AI players notified which challenges need writeups
Fri 6:00 AMQualifier closes; minimal-AI top 5 finalized
Fri 6:30 AMReserved-seat writeups due
Fri 7:00 AMReserved-seat selection complete
Fri 8:30–10:30 AMIn-person final

Ethics

  • Do not brute-force the scoring servers.
  • Do not steal flags from other players. Sharing hints is fine; sharing flags is not.
  • Do not sabotage challenges for other players.
  • Social-engineering other players is permitted.
  • Register with the same email used for SAINTCON; bring a laptop.
  • HC staff reserve the right to disqualify players or adjust scores for rule violations.

Prize

The overall winner receives a Black Badge — free entry to the conference as an attendee.

← Back to the mission briefing