Code: Megapixel99/capture-the-flag
In April I ran five games of an AI capture-the-flag tournament between five small open-weight models (1.0B to 2.5B parameters). Each was given root on an identical Ubuntu container and told to steal /root/flag.txt from the others while defending its own. Qwen 3.5 at 2.3B captured 13 flags and lost none. The other four captured two flags between them. Nobody found any of the five bonus flags planted on each machine, even after hints were revealed at rounds 6, 9 and 12, so I wrote a preliminary report with two conclusions in it:
Model size matters enormously for security reasoning.
Multi-step exploitation is not feasible for models under 3B parameters.
The tournament has since run 327 more games with much larger models, which makes the first conclusion checkable. It does not survive. (This is the second post about this project. The first is about a dedup pass that deleted the training weights, and the two findings are independent.)
