Capture The Flag (CTF)

Capture The Flag is a security skills test where participants search for secret pieces of information ("flags") hidden throughout a computer network. Think of it like a treasure hunt. It's a game where you search keyholes, pick locks, and find hidden boxes inside a fake, simulated building (a virtual network), and the training lets you score how skilled a participant is at penetration techniques.

Originally, it was used as a competition to test human security experts against each other, but these days it's also used as a testbed to check an AI model's hacking abilities and risks. The model is told to find the flag inside a virtual building (a test environment), and by watching the results, evaluators gauge how dangerous the model could be in an actual intrusion attack. The problem arises when this virtual building actually has a door open to the outside world. The model, still believing it's inside the fake building, can end up picking the lock on a real neighbor's door by accident.

Sentence from the article: All three incidents Anthropic identified occurred "during cybersecurity training in the form of Capture The Flag (CTF) exercises." What could be misunderstood here is that CTF itself is not dangerous. CTF is a standard training method originally designed to run in a safely isolated environment, and this incident happened because of a configuration error — the isolated environment was actually connected to the internet.