Back to Feature Flag GraphQL Takeover (generated target)

New challenge

Inject vulnerabilities into a copy of Feature Flag GraphQL Takeover (generated target) on its own branch.

Codebase is not verified deployable

Run the dockerize workflow first. A challenge whose application cannot start cannot be benchmarked.

Challenge

Name

Executor

Uses claude-opus-5 through the configured gateway.

Model The exact Anthropic model the gateway generates with.

Type

Difficulty

Difficulty changes what is asked for, not just how it is labelled. Higher levels require the flaw to be reachable only by understanding how parts interact.

Number of vulnerabilities

Required classes (optional)

Additional instructions

Prompt

Generated from the options above. Edit it directly if you want full control.

Generation time budget (minutes) Generation iterates until this deadline instead of a fixed number of rounds. Run the full pipeline After the challenge builds with placed flags and each flag is checked, automatically run a solvability check: an agent given the exploit guide must capture every flag against the live app. Calibrate difficulty Run a baseline tool against the finished challenge with no writeup to measure how much it can solve unaided, and gate on it. Adds a full baseline solve (roughly 15 to 20 minutes and extra cost).

Cancel