Cybersecurity Competition Highlights AI’s Strengths and Weaknesses
LAS VEGAS: A team of seven cybersecurity specialists gathered in a luxurious suite on the 60th floor of the Cosmopolitan hotel in Las Vegas to participate in a high-stakes cybersecurity contest. Armed with laptops, network cables, Wi-Fi antennas, and a large display screen filled with lines of code, the experts spent two intense days attempting to breach a computer network based in San Antonio.
The exercise was part of the annual National Collegiate Cyber Defense Competition where experienced cybersecurity professionals known as the “red team” launched attacks against systems defended by top computer science students across the United States. These student groups, referred to as “blue teams,” worked tirelessly to block intrusions and protect their networks from compromise.
Alex Levinson, a senior member of the red team, explained that every successful breach or stolen piece of data resulted in penalties for the defending teams. The attackers relied heavily on custom-built malware and advanced tactics designed to challenge the students with threats they had never encountered before.
Hosted by the University of Texas at San Antonio, the competition included ten collegiate teams that had previously won regional contests. This year’s event introduced a groundbreaking addition to the battlefield: artificial intelligence. One of the participating blue teams consisted entirely of autonomous AI agents operating without direct human control.
The competition provided a realistic glimpse into the future of cyber warfare while revealing both the impressive capabilities and current limitations of AI in cybersecurity. AI systems demonstrated the ability to assist with attacking and defending networks, but they still struggled to match the skill, creativity, and judgment of experienced professionals and talented students.
Despite these limitations, AI companies continue to rapidly improve their systems. Recently, Anthropic announced restrictions on access to its advanced AI model, Claude Mythos, out of concern that cybercriminals could misuse the technology. OpenAI also implemented similar limitations, allowing only trusted partners to access certain powerful cybersecurity-related tools.
Among the red team participants was Dan Borges, a 37-year-old security engineer who previously worked with Uber and Scale AI. Sitting at a glass table inside the suite, Borges carefully managed multiple AI agents running on his laptop. The bots assisted him by performing repetitive tasks, allowing him to focus on planning broader attack strategies.
Borges explained that AI agents enabled him to work faster and manage several operations simultaneously. However, the technology was far from perfect. During one operation, an AI bot mistakenly attempted to install malware on Borges’ own computer while trying to analyze how the malicious software worked. Laughing at the incident, Borges described it as one of the worst ideas the AI had produced.
Although AI tools significantly improved efficiency, Borges emphasized that they still required careful supervision and precise instructions. According to him, the challenge was not only commanding the bots but also ensuring they correctly understood human intentions.
Elsewhere in the suite, red team members David Cowen and Evan Anderson relied heavily on Anthropic’s Claude Code to execute sophisticated cyber operations. The AI agents handled tasks with such autonomy that the pair occasionally stepped away for breaks while the software continued probing the San Antonio network.
Cowen, a cybersecurity consultant from Texas, found humor in the unexpected actions of the AI systems. Anderson, who runs a Denver-based security company called Offensive Context, remained calm even when the bots behaved unpredictably.
During one lunch break, an AI bot independently detected newly installed software on a target machine, retrieved the default password from an online database, infiltrated the system, and shared the credentials with other bots. Cowen returned from lunch amazed at the AI’s ability to complete the operation without human intervention.
Even so, Cowen stressed that AI tools are only as effective as the experts controlling them. Both he and Anderson closely monitored every operation to prevent dangerous mistakes and guide the AI toward meaningful objectives.
In a particularly interesting twist, Cowen and Anderson were assigned to attack the AI-powered blue team created by Anthropic. Unlike the student teams, which each consisted of eight human participants, Anthropic’s automated defense system operated with as many as 32 AI agents working together.
The AI-only defense team ultimately secured seventh place out of the eleven participating teams. Dakota State University in South Dakota claimed the championship title once again, continuing its reputation as one of the strongest competitors in collegiate cybersecurity events.
FAQS
What was the National Collegiate Cyber Defense Competition?
It is an annual cybersecurity event where college students defend computer networks against attacks launched by experienced cybersecurity professionals.
What role did AI play in the competition?
AI agents participated as both offensive and defensive tools, helping teams automate tasks and manage cyber operations.
Did the AI-only team win the competition?
No, the AI-only team finished in seventh place out of eleven participating teams.
Why are companies limiting access to advanced AI systems?
Companies like Anthropic and OpenAI fear that powerful AI tools could be misused by cybercriminals for malicious purposes.
What are the limitations of AI in cybersecurity?
AI systems can make mistakes, misunderstand instructions, and still require close supervision from human experts.
Which university won the competition?
Dakota State University in South Dakota won the competition and continued its strong record in cybersecurity contests.
Conclusion
The National Collegiate Cyber Defense Competition demonstrated that artificial intelligence is becoming an increasingly powerful tool in the world of cybersecurity. AI systems can automate repetitive tasks, identify vulnerabilities quickly, and assist security experts in managing complex operations more efficiently. However, the event also highlighted the technology’s current weaknesses, including poor judgment, unexpected behavior, and the need for constant human oversight.
While AI is unlikely to replace skilled cybersecurity professionals anytime soon, it is clearly transforming how cyber warfare is conducted. As companies continue refining these systems, the balance between innovation and security will become more important than ever. The competition served as a reminder that the future of cybersecurity will likely depend on a partnership between human expertise and artificial intelligence.
