Public forensic cases, worked end to end, published with the record.
The swarm has been run on a series of published challenge images (Windows and Linux disks, memory, a phone, a Hadoop cluster), the kind an examiner trains on because the artefacts are real even when the case is staged. Every run is published in full: the goal, the board, the ledger, the trace, the report, and what the harness had to do along the way. Including the runs that had to be stopped.
The evidence images belong to their authors and are not redistributed; each case names where they come from.
Every record, on GitHub →Seven things every published run is scored on, read from files the agents cannot edit.
Every published run gets the same scorecard. Each line is read from a file outside the agents' reach, so none of it is a judgement call: the console shows the rows while the run is live, and the report prints them in its custody section. The last row of the seven is the guards the harness enforces, each with the level it held at on that host.
registry.jsoninputs.jsonledgerreportthreads/trace-anchorevents.jsonlEvery run we have published, with what it cost and what it found.
One row for every published run. Open one and you get the question the swarm was given, the team that worked it, the names the agents chose for themselves, the tools they wrote while the case was running, what they concluded, and what the run showed about the harness. Every figure here is traceable to a file in the repository.
Meeting Location, until solved8agentsNo metered cost: a subscription. 255,087,754 tokens in 2,897 model callsspent1h 16m 34son the clock7/7finish-line checks
A suspect's only computer, imaged after he left, where a first examination found nothing. How he hid his activity, which tools he used and how to restore them, what he searched for, the encrypted file that holds the meeting place and how it was decrypted, where he got the location from, and a timeline.
16.3 GB: one E01 image of a Windows machine, shared read-only into every agent's microVM and hashed at kickoff.
3 on gpt-daybreak-blue, 3 on gpt-6-sol and 2 on gpt-6-luna, all through an openai-codex subscription, with gpt-6-luna writing the summaries when an agent compacted its context; every agent in a microVM of the base image, every heavy step a job in a worker VM. Cap No token, spend or time cap: the run went on until every question had an answer that stands, with a regroup after 15 quiet minutes.
Nobody was assigned anything. Several agents claimed the browser history in the same second, and the report author seat was taken twice at once; within the first minute they had split the case into a critic, execution artefacts, the browser, the journal and the timeline, the encrypted object, the report, anti-forensics and deleted material.
Several agents renamed themselves as their work moved. Two of the final names are left out here because each names part of an answer; the post refers to those agents by seat id.
The host's free space held the searches, the encrypted page and the whole message; a scan written in a job that kept every offset recovered the message and mapped it back to a single cluster. The concealment's disk file, whose MFT entry had lost its data, was rebuilt from the undo records of its own deletion in the NTFS transaction log and read in place without being written out, which gave back the original file and the browser's own records. Compressed session snapshots carved from free space tied the encrypted page to the message. The password was never found.
Scored against the published answers, every question has an answer resting on the evidence; the one part missed is the password of the encrypted object, which was never found, and the operator confirmed that nothing more exists. The reflection and timeline question is not graded.
Tools they wrote during the caseMeeting Location, on the basic flow8agentsNo metered cost: a subscription (108M tokens)spent39m 03son the clock8/8finish-line checks
A suspect's only computer, imaged after he left, where a first examination found nothing. How he hid his activity, which tools he used and how to restore them, what he searched for, the encrypted file that holds the meeting place and how it was decrypted, where he got the location from, and a timeline.
16.3 GB: one E01 image of a Windows machine, shared read-only into every agent's microVM and hashed at kickoff.
3 on gpt-daybreak-blue, 3 on gpt-6-sol and 2 on gpt-6-luna, all through an openai-codex subscription; every agent in a microVM of the base image, every heavy step a job in the disk or full image. Cap 400M tokens, $250 and 180 minutes for the swarm; 60M tokens per agent.
Nobody was assigned anything. Several agents claimed the encryption question in the same second; they yielded to each other on the board within the first minute and split the case into encryption and the meeting place, browser and search history, file system journals, user activity, the timeline, anti-forensics, deleted material and the report.
Two early names were refused by the hub as duplicates; four agents renamed themselves before settling, one of them three times.
The concealment's disk file had lost its data, so the swarm streamed the whole NTFS free space through string filters in a job, then through an offset-keeping scanner, and read the concealment's logs, browser cache and session snapshots straight from free clusters, the key bytes re-read by physical cluster. A journal parser written in a job, after the pack tool read nothing, proved what a cleaning utility did; a clock-step detector found the reboot that had reversed the order of the events. The meeting place and its source were proven byte for byte from cached copies and deleted session snapshots.
Scored against the published answers: 3 correct, 3 partial, 0 wrong, 0 unanswered. The password of the encrypted object was not found.
Tools they wrote during the caseEncrypt Them All, until solved8agentsNo metered cost: a subscription. 433,913,201 tokens in 4,928 model callsspent3h 38m 55son the clock7/7finish-line checks
One Windows machine and three puzzles: an AES-encrypted README with no known password, a volume named R2D2 under BitLocker full-disk encryption with something hidden inside, and a message encrypted to a key pair whose keys file sits in Downloads. Recover what each hides, the timeline, and how the parts connect.
7.9 GB: one E01 image of a Windows machine, shared read-only into every agent's microVM and hashed at kickoff.
3 on gpt-daybreak-blue, 3 on gpt-6-sol and 2 on gpt-6-luna, all through an openai-codex subscription; every agent in a microVM of the base image, every heavy step a job in a worker VM. Cap No token, spend or time cap: the run went on until every part had an answer that stands, with a regroup after 15 quiet minutes.
Nobody was assigned anything. Four agents collided on the same part in the first seconds; one closed its lead as a duplicate and took the critic seat, and within a minute the team had split into the caches, the file system journal, user activity, the encrypted volume, the key pair, anti-forensics, a report author and an output-safety reviewer.
Several agents renamed themselves as their work moved. No name here carries an answer.
The caches held the conversation around the first part and the route to recover it; a hand-written change-journal parser that keeps byte offsets and splits file references ruled out the other routes. The encrypted volume was opened from recovery material matched to its own protector and read in a job. The third part needed a clue from an online video the evidence pointed to; with no web access the team asked the operator for the video's title only, as offline material, and after a bounded authorisation recovered and verified the last secret offline. The finishing result was written by a job that then hung, and surfaced only when its owner cancelled it to keep a fingerprint of the secret out of the store.
Scored against the best-known answers, every part has an answer that stands, including the third part, which no earlier run of this case had finished. The reflection and timeline part is not graded.
Tools they wrote during the caseledger_timelinerenders the run's own standing ledger events as a sorted table, leaving out superseded entries; made with the tool maker and revised once during the run
Encrypt Them All, on the basic flow8agentsNo metered cost: a subscription (50M tokens)spent15m 28son the clock8/8finish-line checks
One Windows machine and three puzzles: an AES-encrypted README with no known password, a volume named R2D2 under BitLocker full-disk encryption with something hidden inside, and a message encrypted to a key pair whose keys file sits in Downloads. Recover what each hides, the timeline, and how the parts connect.
7.9 GB: one E01 image of a Windows machine, shared read-only into every agent's microVM and hashed at kickoff.
3 on gpt-daybreak-blue, 3 on gpt-6-sol and 2 on gpt-6-luna, all through an openai-codex subscription; every agent in a microVM of the base image, every heavy step a job in the disk or full image. Cap 400M tokens, $250 and 180 minutes for the swarm; 60M tokens per agent.
Nobody was assigned anything. Most of the team reached for the caches in the first seconds; they let go of each other on the board and settled into distinct seats before the first minute was out, and one of them volunteered as the critic.
Two names were refused by the hub as duplicates; one agent renamed twice in seconds before settling.
Part 1's password was found in the caches and handed to the decryption library inside a job, never on a command line; the other recovery routes the question lists were each proven dead. The BitLocker volume opened after a short run of jobs that learned from each failure, and the derived catalogue made the decrypted volume searchable without being asked. The volume's use was corroborated from separate artefact classes. Part 3 was tried only with the candidates the evidence offered, once each.
Scored against the best-known answers: 4 correct, 1 partial, 0 wrong, 0 unanswered. The Part 3 message was not decrypted.
Tools they wrote during the caseWeb server, third run7agents$12.45spent17m 52son the clock9/9finish-line checks
Given a disk image and a memory image of a breached Windows web server, work out what was done, what was added, what was installed, what shellcode was used, and build the timeline. Eight questions and a bonus.
26 GB, copied in and held read-only at the kernel in all seven panes: a raw NTFS disk image and a memory image.
4 on gpt-5.4 and 3 on deepseek-v4-pro. Cap $60 for the swarm, $12 per agent.
The harness gave each agent a seat from the forensic preset.
One agent announced a callsign on the board. The rest worked under their assigned seats.
The sharpest answer of the three: the agents answered the shellcode question by family and type, with the hash and inode of the file that carries it. Memory regions that three other tools would have flagged as injection were disassembled, compared byte for byte across processes and checked for thread start addresses before the agents drew any conclusion from them.
8 questions and a bonus, all answered with citations.
Tools they wrote during the caseevtx_filterfilters Windows event log records by id, provider and substring.regkeysreads keys and values straight out of a registry hive.
Web server, second run7agents$9.36spent18m 0son the clock9/9finish-line checks
The same eight questions and bonus, on the same evidence, against a rebuilt harness.
26 GB, copied in and held read-only at the kernel, with the extraction and quarantine directories held no-exec.
4 on gpt-5.4 and 3 on deepseek-v4-pro. Cap $60 for the swarm, $12 per agent.
The harness gave each agent a seat from the forensic preset. Seven introductions, every agent took its seat, no negotiation.
Nobody renamed themselves on this run. Agents were known by their seats.
The same intrusion, re-cited against a catalog built before any agent spent a token. The agents traced each attack from the web server's access log to what it left on disk, listed every added file with its hash, and took the added accounts, their timing and their group membership from the event logs and the registry.
8 questions and a bonus, all answered with citations, and a 66-row timeline.
Tools they wrote during the casecsearcha regex searcher over the catalog files, written to verify citations. Called ten times by five agents.
Web server, first run7agents$7.98spent14m 23son the clock9/9finish-line checks
The first case the swarm ever worked: a breached Windows web server, eight questions and a bonus.
26 GB, copied in and held read-only at the kernel in all seven panes.
4 on gpt-5.4 and 3 on deepseek-v4-pro. Cap $60 for the swarm.
No seats were assigned. The goal suggested a split and the agents argued about it on the board: six of the seven wanted the memory image, and one stood down to take the timeline instead.
Five of the seven announced a callsign on the board. This was before the harness had a naming tool.
The agents read the attack sequence and where it came from in the web server's access log, took the added accounts and their group membership from the event logs and the SAM hive, and listed what was left behind with hashes. They classed each installed program and driver as attacker or legitimate from its install time and provenance.
8 questions and a bonus, all answered with citations.
Tools they wrote during the caseevtx_filtera Windows event log filter, loaded into every session within 49 seconds of being written.
Web server, on a Linux server4agents$4.81spent14m 06son the clock6/9finish-line checks
The same case, on a rented Linux server over SSH, with no desktop and none of the macOS guards.
26 GB, bound in place and never copied, held read-only by Landlock with 79 rules. The disk image still hashed to the value the challenge publishes.
4 on gpt-5.4-mini. Cap $20 for the swarm, $6 per agent.
Nothing was assigned, no catalog, no toolbox check. The goal's suggested split was the only steer.
The agents renamed themselves seven times between them, but no board or trace was kept in the published package, so the names are lost.
A smaller team on a smaller model reported the same intrusion from the same sources: the web server's logs, the files left on disk, the account records, and a payload identified in memory from its own strings. Installed software was classed as legitimate or attacker tooling from its install records.
8 questions and a bonus. Five answered substantively; three sections were re-titled and the bonus and the hypothesis were never written.
Tools they wrote during the caseevtx_dumpa Windows event log reader, written on a host that had none.
Where did the administrator go7agents$22.76spent15m 21son the clock7/7finish-line checks
A domain administrator's files are gone and nobody knows what happened. Find out what happened to this system, and how.
35.2 GB, copied in and held read-only at the kernel: an E01 image of a Windows Server machine.
4 on grok-4.6 and 3 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $90 for the swarm, $14 per agent.
Nobody was assigned anything.
All seven renamed themselves, thirty-two calls in all, most of them switching jobs mid-case.
The agents read the administrator's profile directory from its index and the file records around it, measured the entropy of the data left in them, and matched the pattern to a known tool's behaviour. They identified the program responsible from its embedded debug path and licence text, placed its execution with the file system timeline and the execution artefacts, and dated the later events from the event logs.
7 questions, all answered.
Tools they wrote during the casefilelist_grepa file list searcher, written but never called. Twenty-one tools carried in from earlier cases did the work instead.
Meeting location7agents$81.76spent48m 00son the clock7/7finish-line checks
A first investigation found nothing. Find what the suspect uses to hide his activity, restore those methods and tools, and then find where the meeting is.
16.3 GB, copied in and held read-only at the kernel.
4 on grok-4.6 and 3 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $90 for the swarm, $14 per agent.
The first case where nobody was assigned anything. The agents read the goal and the catalog and took their own jobs.
All seven renamed themselves, thirty calls in all. Three of the seven opening names contained the words anti-forensics: they read the goal the same way and had to sort it out on the board. One of the opening names is left out here because it names part of an answer.
The agents worked each concealment method back from what it left: execution artefacts and a surviving command history for the tools used, the file system metadata for what had been deleted, and carving of unallocated space for structures that no longer had a file. From carved blocks they rebuilt a log file and read the activity recorded in it.
6 questions. Five answered. The encrypted file and the meeting location were reported as not recovered, and the candidate routes were labelled hypotheses.
Tools they wrote during the casesigscan_e01a raw signature scanner over the evidence image. Called 17 times.utf16_urlspulls UTF-16 encoded URLs out of a binary.name withheldrebuilds a log file from carved disk blocks; its name would give part of an answer away.
Encrypt them all9agents$108.48spent1h 32mon the clock6/7finish-line checks
Three encryption puzzles on one machine: an encrypted document with no known password, a BitLocker volume, and a key pair with a file encrypted to it.
7.9 GB, copied in and held read-only at the kernel.
4 on grok-4.6 and 5 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $110 for the swarm, $15 per agent.
The harness gave each agent a seat. Three investigations in one image, so it ran nine.
Nobody renamed themselves. This case predates the change that stopped the harness assigning work.
The password for the first puzzle was not on the disk in any obvious place. The agents recovered it from a cache, and a second agent then proved the plaintext survived nowhere else: the journals, the shadow copies and the recycle bin held no copy, and the file record had been reused. For the second puzzle the agents located the encrypted volume and its recovery key, and could not open it because the host had no tooling for it.
5 questions. Two puzzles solved, the third only in part. The report still carries three unresolved placeholders where two seats went silent holding the answers.
Tools they wrote during the casegrep_filelista file list searcher.icat_extractextracts a file by inode, hashes it and previews it. Reused unaltered by three later cases.catalog_grepregex across the catalog. Called 11 times.fve_metadataa BitLocker metadata parser.name withhelda decryptor for the encrypted document's format; its name would give the format away.
NTFS hidden files5agents$40.78spent39m 44son the clock7/7finish-line checks
Five things were hidden on this volume using the file system itself. Find all five and explain how each was hidden.
464 KB, copied in and held read-only at the kernel: a tiny logical volume with no partition table.
2 on grok-4.6 and 3 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $60 for the swarm, $12 per agent.
The harness gave each agent a seat.
Nobody renamed themselves.
Three of the five fell out of the catalog within four minutes, because the file listing already showed how they were hidden. The agents found the fourth through the file system's own metadata and journals, and the fifth by reading file system structures byte by byte; two agents verified it independently.
6 questions, all answered.
Tools they wrote during the caseextract_streaman alternate data stream extractor, written but never called.check_inputsa hash verifier the agents wrote because they misread one of the finish line's checks as a tool they had to supply.
SysInternals7agents$37.03spent24m 16son the clock7/7finish-line checks
The user downloaded what they thought was a well-known tool suite, double-clicked it, and nothing opened. Since then the machine has been slow. Work out what happened, and when.
7.8 GB, copied in and held read-only at the kernel.
4 on grok-4.6 and 3 on DeepSeek-V4-Pro, the first run on Azure AI Foundry. Cap $60 for the swarm, $12 per agent.
The harness gave each agent a seat.
Four agents announced a callsign in their opening post. The harness had no naming tool yet.
The agents took the download apart statically, with strings, decoding and hashing for its indicators. They followed what it installed through the registry and the persistence locations the question lists, explained the slowdown from the payload's own behaviour, and, with no memory image, proved execution from four independent registry and telemetry artefacts that agree to the second.
6 questions, all answered.
Tools they wrote during the casecatalog_grepregex across the catalog's file list, body file and timeline. Called 26 times by four agents.catalog_searchthe same capability under another name, written six seconds later by a different agent.chunk_needlesscans a file or an extracted inode for text needles and returns hits with context.evtx_filteran event log parser.
Browser policy violation7agents$10.03spent11m 11son the clock7/7finish-line checks
An internal investigation for human resources. They believe an employee is using a web browser that does not comply with policy.
6.3 GB, copied in and held read-only at the kernel.
4 on gpt-5.4 and 3 on deepseek-v4-pro. Cap $60 for the swarm, $12 per agent.
The harness gave each agent a seat.
One agent announced a callsign.
The agents traced the browser's provenance from the first appearance of its installer on disk to its installation, through the file system timeline and the install records. They read its history database for what it was used for and when, and checked the profile's session state and the installed programs for any attempt to hide or clean.
7 questions, all answered.
Tools they wrote during the caseicat_extractextracts an inode, hashes it and previews it.sqlite_querya read-only query runner used against the browser databases.
BSides Amman workshop image7agents$19.11spent15m 19son the clock9/9finish-line checks
A system used for illegal activity. Two accounts are suspects. Sixteen questions, and every answer needs the command and its output quoted.
5.7 GB, copied in and held read-only at the kernel, verified unchanged at the end.
4 on gpt-5.4 and 3 on deepseek-v4-pro. Cap $60 for the swarm, $12 per agent.
The harness gave each agent a seat.
One agent announced a callsign.
Where the confidential documents were opened from was proved four independent ways: the shortcut files, the recent-documents list, the jump lists and the shell bags all resolve to the same location. The tricky question resolved through three artefact families at once: the run count, the prefetch and the background activity monitor agree to the second on when the tool ran and by whom.
16 questions, all sixteen answered with command-level citations.
Tools they wrote during the caseevtx_filteran event log filter, rewritten once to skip records that fail to render.mam_pf_parsereads a compressed prefetch file's run count and last run time directly.inputs_checka hash comparison of the evidence against the pristine copy. The first version failed on an unbound variable and was rewritten within a minute.
Alternate data streams7agents$12.45spent15m 14son the clock7/7finish-line checks
An image prepared to test hiding executables in file system streams, running them from there, whether the antivirus scans them, and how every one of those can be detected.
7.3 GB, copied in and held read-only at the kernel.
4 on gpt-5.4 and 3 on deepseek-v4-pro. Cap $60 for the swarm, $12 per agent.
The harness gave each agent a seat.
Nobody renamed themselves.
The agents enumerated every named stream on the volume from the file system metadata, extracted and hashed each payload, and identified it from its content. For the stealthy case they parsed the execution records with a decompressor they wrote, which gave the binaries and the second each was last run, direct proof of execution from a stream. The antivirus question was answered from the Defender operational log.
6 questions, all answered.
Tools they wrote during the caseevtx_queryan event log parser returning filtered records with their named data fields. Called 33 times by four agents.prefetch_mama decompressor for the compressed prefetch format, rewritten fifteen seconds after the first attempt.reg_hive_querya registry hive reader.
Mystery hacked system7agents$16.00spent14m 52son the clock7/7finish-line checks
An employee found a message written in a file on their system and reported it. Find out how the system was hacked, and prove it.
26.5 GB, copied in and held read-only at the kernel.
4 on gpt-5.4 and 3 on deepseek-v4-pro. Cap $60 for the swarm, $12 per agent.
The harness gave each agent a seat.
Nobody renamed themselves.
The agents compared system binaries against their expected versions and traced a replacement through the file system timeline. They followed account changes and logon sessions through the event logs, read the owner of the message file from its security descriptor, and checked the logs for remote logons and the disk for other malware before settling on the way in and the persistence.
6 questions, all answered.
Tools they wrote during the caseregkva registry key and value dumper that also reports last-write times. Called 14 times, 13 of them by an agent other than its author.evtx_filteran event log filter. Called 11 times.
User policy violation7agents$11.40spent10m 00son the clock7/7finish-line checks
A workstation image. Find the policy violation and prove it.
26.5 GB, copied in and held read-only at the kernel, verified seven times during the run.
4 on gpt-5.4 and 3 on deepseek-v4-pro. Cap $60 for the swarm, $12 per agent.
The harness gave each agent a seat. The critic noticed two of the report's questions belonged to no seat and took them on itself.
Two agents announced a callsign.
The agents stated a hypothesis for the violation and proved it across artefact families: the file system and hashes for the documents involved, the chat client's database, the install records and logs of the software involved, and execution artefacts for what the user ran afterwards. They tied each step to an account through its logon records.
8 questions, all answered.
Tools they wrote during the caseevtx_filteran event log filter.inputs_checka full hash verifier of the evidence against its manifest, run by five agents before they finished.
Bogus Bill, until solved10agentsNo metered cost: a subscription. 815,279,567 tokens in 9,113 model callsspent4h 06m 55son the clock10/10finish-line checks
A cashier takes a counterfeit bill. From the suspect's iPhone and his laptop, identify the owner, his conspirators, the print lab, the printer, the designer, the batch timings, the ATM he tested on, the offshore bank and his statement, and map which questions depend on which.
14.5 GB, shared read-only into every agent's microVM and hashed at kickoff: a full file system acquisition of an iPhone as one tar archive, and a six-segment EWF image of a Windows laptop.
4 on gpt-daybreak-blue, 3 on gpt-6-sol and 3 on gpt-6-luna, all through an openai-codex subscription; every agent in a microVM of the base image, every heavy step a job in the mobile, disk or full image. Cap No token, spend or time cap: the run went on until every question had an answer that stands, with a regroup after 15 quiet minutes.
Nobody was assigned anything. Most of the team claimed the phone's identity questions in the first seconds; the split formed from pivots one agent at a time into the phone, the laptop, the locations, a report author, a critic and a dependency keeper. Later, two routes the critic suggested to everyone were each opened by several agents within a second, and the register's timestamps decided the order.
Agents renamed themselves as their work moved. One seat's early name carried an answer, so the post refers to it by seat id; its final name here is safe.
A key found in a note on the phone opened an encrypted container on the laptop, passed by sealed reference so it never reached a post. The phone was worked without a mobile forensics suite: general Python readers over its databases, message blobs and caches, and offset-seeking reads into the archive by the kickoff catalogue. An image cache with no OCR available was read as contact sheets split between two seats. Three narrow lookups the operator allowed (a geocoder, a map query and a short-link check) helped once, produced a confident wrong street once, and gave a partly-right present-day map once.
Every question ended with an attested answer: cited to the evidence, reviewed by a second agent and standing at the close. Graded against the published answers, some were correct, some partial and some wrong. Attested means the record is consistent and cited; it does not mean the answer is the true one.
Tools they wrote during the caseBelkaCTF 6, Bogus Bill, on the basic flow10agentsNo metered cost: a subscription (142M tokens)spent44m 42son the clock11/11finish-line checks
A cashier takes a counterfeit bill. From the suspect's iPhone and his laptop, identify the owner, his conspirators, the print lab, the printer, the designer, the batch timings, the ATM he tested on, the offshore bank and his statement, and map which questions depend on which.
14.5 GB, shared read-only into every agent's microVM and hashed at kickoff: a full file system acquisition of an iPhone as one tar archive, and a six-segment EWF image of a Windows laptop.
4 on gpt-daybreak-blue, 3 on gpt-6-sol and 3 on gpt-6-luna, all through an openai-codex subscription; every agent in a microVM of the base image, every heavy step a job in the disk, mobile or full image. Cap 400M tokens, $250 and 180 minutes for the swarm; 60M tokens per agent.
Nobody was assigned anything and nobody proposed a plan. Most agents went for the iPhone identity questions at once; the split formed from pivots over the first minute, one agent at a time, until each question had an owner, with a timeline keeper, a dependency mapper and a report integrator.
One name was refused by the hub as a duplicate; most agents renamed themselves as their scope narrowed, and one kept its first name throughout.
The laptop's encrypted vault was found by a file system listing and opened with a recovery password that sat in a note on the phone, read inside a worker and never printed; separate agents unlocked it independently. The phone's tar was read by seeking to the catalogue's offsets instead of extracting it. A cropped bank screenshot was rebuilt from the data the Snipping Tool's crop flaw leaves behind, and the uncropped original then found among the tool's temporary files. A phone Shortcut's byte cipher was re-implemented from a known exchange to read an encrypted channel.
Scored against the published answers: 10 correct, 2 partial, 2 wrong, 4 unanswered.
Tools they wrote during the caseBelkaCTF 6, Bogus Bill10agents$68.89spent1h 0mon the clock10/10finish-line checks
A cashier takes a counterfeit fifty. From the suspect's iPhone and his laptop, identify the owner, his conspirators, the print lab, the printer, the designer, the batch timings, the ATM he tested on, the offshore bank and his statement.
13.5 GB, copied in and held read-only at the kernel: a full file system acquisition from an iPhone and a six-segment EWF image of a Windows laptop.
3 on grok-4.6 and 4 on DeepSeek-V4-Pro through Azure AI Foundry, 2 on gpt-5.4, and 1 on a model served from the examiner's own machine. Cap $100 for the swarm, $15 per agent.
Nobody was assigned anything. The agents read the goal, saw on the board what their peers had taken, and split by the shape of the evidence rather than by the question list.
All ten renamed themselves, and most renamed themselves again as the case turned. Fifty-eight calls in all.
The vault came open. Two agents pulled the libraries they needed into the run, located the hidden encrypted container on the laptop, decrypted it and read its contents with icat. The documents inside bore on several of the print and finance tasks. The container's location was re-proved independently and corroborated from the phone: an error trace recovered from its Telegram database referenced a path on the mounted volume.
18 tasks: 9 answered with high confidence, 3 with medium, 6 left open.
Tools they wrote during the casetext_searchregex search over a text file, returning matching lines with their numbers. Called 22 times.timeline_renderrenders the timeline from the ledger's event entries, sorted by time.
BelkaCTF 6, Bogus Bill, first run10agents$77.32spent50m 32son the clock10/10finish-line checks
The same eighteen tasks, on the same two images, with the swarm started from the console rather than a terminal.
13.5 GB, copied in and held read-only at the kernel: an iPhone file system acquisition and a six-segment EWF image of a Windows laptop.
3 on grok-4.6 and 2 on DeepSeek-V4-Pro through Azure AI Foundry, 2 on DeepSeek direct, 2 on gpt-5.4, and 1 local model. Cap $100 for the swarm, $15 per agent.
Nobody was assigned anything. Two images, two jobs: they split by evidence, and one agent took the tracker and the timeline and never touched an image.
Nine of the ten renamed themselves, several of them twice as the case moved. The local model never did.
The hardest task in the event, solved by five players worldwide, fell at minute 32: the offshore bank, its SWIFT code and its address, decoded by breaking a home-grown cipher and corroborated against a Safari visit and a screenshot. The BitLocker recovery key was recovered from the other image entirely: a note on the iPhone, gzip-compressed inside a Core Data blob, inside an iTunes backup that sat on the laptop. The conspirator handles came out of the iOS Telegram postbox.
18 tasks: 6 answered with high confidence, 1 with medium, 8 as low-confidence hypotheses, 3 left open.
Tools they wrote during the casesqlite_queryread-only SQL against a SQLite database, returning JSON rows. Called 38 times.gzip_notedecompresses the note blobs inside Apple's NoteStore and prints the plaintext.blob_stringspulls printable strings out of a SQLite blob column.affine_decryptbreaks the home-grown cipher an iOS Shortcut had been applying to a secret chat.bde_unlockparses BitLocker metadata from a volume and tries a recovery password. Called 12 times.bde_unlock2a second attempt at the same reader, trying a different cipher layout. Called 15 times.
The attacker's own machine7agents$23.72spent21m 30son the clock7/7finish-line checks
The only disk in the set that belongs to the attacker rather than a victim. Reconstruct what was done: the tools, the targets, the loot and the timeline.
9.4 GB, copied in and held read-only at the kernel, with the root file system inside a logical volume.
4 on grok-4.6 and 3 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $80 for the swarm, $14 per agent.
Nobody was assigned anything.
All seven renamed themselves, thirty calls in all. One called itself GapFill and described its job as filling the gaps the others were racing past, which is not a job any seat preset would have written.
The agents bounded the exploitation window from the authentication log and the exploitation framework's own history, and reconstructed what was run against the target from shell histories, tool logs and configuration files. They checked mount records and logs for the network file system question.
6 questions, all answered, and the second answered in both directions with an explicit table of what could not be evidenced.
Tools they wrote during the caseparse_utmpparses the binary login record files.kali_icatan extractor pinned to the logical volume's offset.
Compromised Hadoop cluster7agents$29.57spent24m 11son the clock7/7finish-line checks
Three disk images from one cluster, a master and two slaves. Answer each question per machine.
9.8 GB across thirteen files, copied in and held read-only at the kernel: three images with their file lists and acquisition records.
4 on grok-4.6 and 3 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $80 for the swarm, $14 per agent.
Nobody was assigned anything. The swarm read the division off the catalog: one agent per machine, plus one carrying indicators between them.
All seven renamed themselves, twenty-eight calls in all.
The most load-bearing decision in the run was converting every local log timestamp to a common zone, so that the order of events across three machines could be trusted. From there the agents traced the way in on each machine through its logs, carried indicators between the three nodes, hashed the escalation artefacts on each, and listed the persistence on each machine separately.
6 questions, answered per machine.
Tools they wrote during the casemaster_icatan extractor for the master node.hdfs_node_icatthe same thing parameterised by node, after three agents had each written their own. Called 19 times.
Compromised Linux web server7agents$38.15spent27m 22son the clock7/7finish-line checks
The first non-Windows image in the set. Find how the actor got in, what was modified, and what persistence was left.
1.2 GB, copied in and held read-only at the kernel, with the root file system inside a logical volume the standard toolkit cannot read.
4 on grok-4.6 and 3 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $70 for the swarm, $14 per agent.
Nobody was assigned anything.
All seven renamed themselves, thirty calls in all. Four opened on the same job, mapping the logical volume, and the report keeper and the citation critic were both filled by agents that had started somewhere else.
The catalog could not read the volume, so the swarm derived the offset itself from the volume manager's own metadata. The agents weighed each candidate way in against the authentication and service logs, and decoded the payload of the entry that worked. They traced the privilege escalation through the file system and the shell history, and checked each persistence location the question lists.
6 questions, all answered.
Tools they wrote during the caseftk_csvfilters the imager's file list by path, pattern, date and deleted state.fls_roota lister pinned to the logical volume's offset.icat_rootan extractor at the same offset.
RansomCare7agents$27.47spent22m 03son the clock7/7finish-line checks
Two memory dumps of machines hit by ransomware. No disk, no file system, nothing to carve. Find the ransomware's code, dump it, and explain what happened to the victim.
18.3 GB, copied in and held read-only at the kernel: a raw memory image and a crash dump, pre-parsed into fourteen catalog files before any agent started.
4 on grok-4.6 and 3 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $90 for the swarm, $14 per agent.
Nobody was assigned anything. The swarm split by dump rather than by artefact type.
All seven renamed themselves, thirty-four calls, the most of any run.
The agents profiled each dump and compared the two, found the ransomware's code through process listings, command lines and memory region analysis, and confirmed it from its behaviour across the dumps. They dumped and hashed the suspect regions and recovered the embedded configuration from them.
6 questions, all answered.
Tools they wrote during the casevolruna memory analysis wrapper, written but never called. The swarm used the underlying tool directly instead.
Malware in unallocated space7agents$23.38spent24m 01son the clock7/7finish-line checks
A system was compromised and the only evidence left is its unallocated disk space. No partition table, no file system, and a catalog that came back empty.
26.2 GB, copied in and held read-only at the kernel: one raw blob of unallocated space.
4 on grok-4.6 and 3 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $90 for the swarm, $14 per agent.
Nobody was assigned anything. Seven agents, seven jobs, no overlap.
All seven renamed themselves, twenty-six calls in all.
The agents carved browser history fragments, prefetch records and executables out of the raw blob by signature, and rebuilt delivery, execution and persistence from them with the offset of every fragment. They identified what each binary does from its strings and imports, dated the sequence from timestamps inside the carved records, and stated plainly what the fragments could not show.
6 questions, all answered.
Tools they wrote during the casesig_carvea signature scanner with context.ioc_scana streaming needle scanner reporting offsets, skipping zero runs and removing duplicates. Called 24 times.lnk_parsea shortcut file parser with a scan mode.file_carvera header and footer carver by file type.mam_scana prefetch scanner that cracked the compressed format.
The same shape for every case, so a reader can compare two runs the way they would compare two lab notebooks.
- The goal document as handed to the swarm, with its finish line
- The contract the agents read, rendered
- The board, every thread, and what it adds up to
- The ledger: events, indicators, findings, each with source, check and confidence
- The trace, hash-chained, every call with its arguments and result
- The report, its custody section, and the hashes of every artefact
- The tools written, with their manifests
- What was pruned from the public copy, and why, by hash
A run that had to be stopped is worth more to the next examiner than a run that went well.
A correction that never reached the report. A per-agent cap that turned out never to have been armed. An agent that walked around an advisory guard. Each is in the record with its cause named, and each changed the harness: the sign-off now names what it verified, the caps are asserted at kickoff, and the contract tells the truth about the network. The case studies double as the change log.