Harkonnen Places 4th at a CMD+CTRL Web-App Cyber Range — Fully Autonomous, 6 of 8 Vulnerability Categories Cleared

I pointed Harkonnen — my self-learning agentic orchestrator for offensive security — at a live web-application cyber range and let it run fully autonomously, no human hands on the keyboard. Competing on the public leaderboard of a CMD+CTRL event affiliated with OWASP Los Angeles and LV CyberJutsu ("Hack through the Heat"), it went from a cold start — zero solved — to a 4th-place finish, clearing six of eight vulnerability categories to 100%.

What It Cleared (No Spoilers)

The target was a deliberately vulnerable banking application — 48 challenges spanning the full OWASP-style spectrum, graded live by the platform's own scoreboard. Harkonnen worked it the way a senior application pentester would: map the entire attack surface first, then move category to category without retooling between them. A few of the harder wins, kept spoiler-free:

• Injection. Found and exploited several distinct SQL-injection points, then pivoted each from reading data it shouldn't to modifying the database outright — including one genuinely non-obvious point where a user-supplied value ends up building a database statement in a place most testers never think to look.
• Broken authentication. Took over a high-value account by chaining leaked data with open-source intelligence on the target's own public profiles — the exact way a real attacker links a breach to a person.
• Cross-site scripting. Landed executing payloads across error, search, and transaction-confirmation surfaces the developers had left unencoded.
• Business logic & access control. Abused hidden form fields, negative-quantity trades, and object-reference manipulation to move money and read other users' data it was never authorized to touch.
• Cryptanalysis & vulnerable components. Broke classical ciphers to recover hidden content, and turned a documented backdoor in an out-of-date component into a scored finding.

A recurring theme — the same one that shows up in every real engagement: when a first attempt failed, the system re-examined the assumption instead of trusting a stale "blocked" verdict. Several challenges fell only because it went back and reconsidered from a fresh angle.

Why It Matters

This is a clean, like-for-like public arena: the same target, the same access, a live field of human and AI competitors. A top-4 finish, run autonomously, with a near-complete sweep of the vulnerability spectrum, is an independent signal that the system produces real results — not demo-grade ones. It finds genuine, exploitable weaknesses across authentication, injection, access control, and business logic — the same classes that headline real breach reports — and it confirms each one against the target's own ground truth rather than declaring victory on a hunch.

For a security leader, that's the difference that matters: an operator that surfaces findings you can act on, with the evidence attached, at machine speed and breadth.

The Engineering Behind It

Building Harkonnen is my work as an AI engineer, and this run is a useful window into the kinds of systems I design and ship:

• Autonomous, long-horizon orchestration. An open-ended objective ("find and exploit everything") decomposed into steps, executed against a real system, and driven to completion with no human in the loop — a durable multi-stage workflow, not a one-shot prompt.
• Oracle-grounded verification. Every claimed result is proven against the target's own ground truth before it counts. No self-congratulatory "I think that worked."
• Self-correction. The loop recovers from dead-ends and re-tests its own assumptions — several wins came only after it revisited something it had earlier judged impossible.
• Generalization across the vulnerability spectrum. One system handled injection, XSS, access control, business logic, cryptanalysis, and authentication without per-class hand-holding — the real test of a general operator versus a bag of narrow scripts.
• Memory that compounds. Techniques and lessons it discovers carry forward, so each engagement makes the next one sharper instead of starting cold.
• Tooling on demand. When a task needed a capability out of the box, the agent built and ran its own tooling to get it.
• Responsible scope. Everything ran strictly inside the event's sanctioned rules, against isolated, authorized practice targets.

In stack terms this lives at the intersection of LLM agent design, tool and runtime integration, systems and security engineering, and evaluation — the full loop from model behavior to verified real-world action.

Where I'm Headed

Capture-the-flag and cyber ranges are a proving ground, not the destination. The same orchestration that took 4th on this board is what I'm taking into live bug-bounty programs and real engagements — finding and responsibly reporting genuine vulnerabilities at machine speed. This event was a benchmark; the real targets are next.

Results above are from an authorized CMD+CTRL cyber-range event ("Hack through the Heat," affiliated with OWASP Los Angeles and LV CyberJutsu), where all activity is conducted against sanctioned, isolated practice targets under the event's rules of engagement. Harkonnen is my self-learning agentic orchestrator for offensive security.