mubix/ai-ctfLocal AI Capture-the-Flag platform with guided lessons on prompt injection, tool-call abuse, and OSINT against six simulated chatbot personas.
A local AI Capture-the-Flag with guided lessons for technologists new to prompt injection. Players can also explore six AI personas (one hidden) that protect 20 flags via prompt-injection, tool-call abuse, business-logic manipulation, supply-chain fingerprinting, web recon, and OSINT.
The guided path covers direct injection, tool authorization, and injection through an editable knowledge article. It provides hints, saved attempts, tool evidence, completion feedback, and protected tool comparisons. The original practice labs retain manual event scoring. Model inference runs locally through Ollama; after the build and model download, the core platform needs no internet connection.
Email Joe in Product Sales adds a simulated inbox and Windows-style desktop. Write an email that Joe's assistant will read, then watch the actual model summary and recorded actions. Three objectives cover a misleading sales brief, disclosure of a fictional internal file, and an unauthorized discount. No mail server, Windows, Wine, or additional model is required.
ai-ctf/
├── README.md ← you are here
├── LICENSE ← MIT
├── platform/ ← everything that runs in Docker
│ ├── flags.toml ← central config: edit this to customize flag values
│ ├── docker-compose.yml ← three services: web, ollama, decoy
│ ├── Dockerfile ← the web app image
│ ├── app/ ← FastAPI source (config, personas, tools, chat)
│ ├── data/init.sql ← SQLite schema + fake-employee seed data
│ ├── decoy/ ← tiny nginx with two flag pages
│ └── scripts/
│ ├── apply_flags.py ← stamps flags.toml values into static files
│ ├── render_secret.py ← runs at container startup
│ └── dump_chats.py ← exports the chat log as HTML (event-day tool)
├── external_artifacts/ ← what you push to GitHub / Gist / DNS
│ ├── README.md ← setup checklist
│ ├── anvil_chatkit/ ← the fake supply-chain package
│ ├── gist_content.md ← paste this into a public Gist
│ └── dns_records.txt ← TXT record to add to your domain
└── docs/ ← run-the-event paperwork
├── ANSWER_KEY.md ← guided solutions + original 20-flag answers
├── CHEAT_SHEET.md ← working solutions + tiered hints (GM only)
├── OPERATIONS.md ← updates, backups, and troubleshooting
├── SETUP_RUNBOOK.md ← week-of, step-by-step
└── EVENT_DAY_NOTES.md ← briefing script + troubleshooting
Use the quick start below for the guided path. The operations guide covers updates, backups, recovery, and pre-event checks. The answer key, cheat sheet, setup runbook, and event notes describe the optional original CTF format.
apply_flags.py and
dump_chats.py helper scripts — the app itself runs inside Docker).exiftool (only needed if you change the EXIF flag and want
apply_flags.py to re-stamp the logo).pip install and the Ollama model pull).
After that the core local stack runs offline. The optional external OSINT chain needs internet access.git clone https://github.com/mubix/ai-ctf.git
cd ai-ctf/platform
# 1. Session secret
echo "SESSION_SECRET=$(python3 -c 'import secrets; print(secrets.token_hex(32))')" > .env
# 2. (Optional) Customize flag values — see "Customizing the flags" below.
# Default values work fine for a smoke test.
# 3. Build and start
docker compose build
docker compose up -d ollama
docker compose exec ollama ollama pull qwen2.5:7b-instruct-q4_K_M
docker compose up -d
# 4. Open the platform
open http://localhost:18080/ # or your-machine-ip:18080 on another laptop
Register a username; the platform generates a 12-character password and shows it once. Save it for later. You are signed in automatically and can select Start learning. Returning players can log in to resume saved progress.
The Compose project is named ai-ctf and has its own network and model volume.
Only the web UI publishes a host port: 18080 by default. Set CTF_WEB_PORT
in platform/.env to choose another port. Ollama and the decoy have no published
host ports; the app connects to its own Ollama container. No GPU passthrough is
configured. CPU and memory are still shared with other workloads on the host.
If upgrading a stack created under a different Compose project name, keep that
name with docker compose -p YOUR_EXISTING_PROJECT ... to reuse its containers
and model volume. Changing project names creates a separate stack.
The guided Customer Service lesson uses a fresh audit token per attempt rather than the fixed event token. It recognizes plain-text disclosures and distinguishes viewing the worked example from solving without it. Fresh attempts preserve previous conversations and earned progress. Its beginner profile deliberately trusts a claimed support-operator role; the original Customer Service practice bot stays separate. Existing guided attempts retain their earlier profile until the player starts fresh.
Two more guided lessons use isolated fictional fixtures: HR tool access, then an editable knowledge article that can redirect a simulated reply. They execute schema-validated model action requests against those fixture tools, record the tool calls, and validate their results. Players can replay the same arguments through a permission check and inspect a legitimate-use control. This comparison checks the tool boundary, not a second model run. Nothing is emailed and no real HR service is connected. The original personas remain self-directed practice labs with their original answers and manual scoring.
The email scenario is available from All lessons → Email Joe. Its File Explorer
uses familiar paths such as C:\Users\Joe\Documents\Sales; these identify in-memory
fixtures and never access the host filesystem. Each email gets fresh fictional files,
an outbox, and a sales record. Story events are labeled separately from observed model
and tool activity. File-disclosure and record-change objectives require executed actions,
not a claim in the summary. Enable Enforce Joe's tool permissions to rerun either
tool objective with application checks, then send a clean example to check normal use.
Attempts, hints, worked-example use, and progress are saved.
For an existing installation, application/template changes require rebuilding the web image; restarting alone does not copy updated code:
cd platform
docker compose up -d --build web
Lesson tables are created on startup without deleting existing accounts or chat history. Follow the operations guide to back up an existing installation before updating and check that players can resume their lessons afterward.
The platform self-contains 16 of the 20 flags. The remaining 4 (#14–17) require
external infrastructure that you push yourself — see
external_artifacts/README.md. Skip that step if you only want the in-platform
half.
All 20 flag values live in one file: platform/flags.toml. Edit values
there to give your event its own flavor (different flag{adjective_noun}
tokens, different coupon code, different CEO salary, etc.).
After editing: