Tag: PhysicalAISecurity

At DEF CON 34’s Capture the Flag (CTF) Car Hacking Village (CHV) Automotive Hacking competition, AUTOCRYPT’s 12-member Red Team became the first among 83 participating teams to complete all required challenges, securing the championship just 25 hours into the 50-hour competition (Link). Since first participating in 2022, the team has continued to advance on the global stage, progressing from third place in 2025 to first place in 2026.

While the numbers capture the final outcome, they reveal little about what lies beyond the scoreboard: years of automotive cybersecurity research and field experience, individual expertise bought together as a collective capability, and a human-AI collaborative workflow designed to expand the speed and breadth of security analysis.

Looking beyond the final ranking, we take a closer look at the experience and approaches behind AUTOCRYPT’s DEF CON 34 victory, and what the team is carrying forward from it.

Following the Red Team’s return from DEF CON 34, AUTOCRYPT brought together all 12 team members and company leadership at its Seoul headquarters to celebrate the company’s first CHV CTF championship.

The gathering was more than a celebration. It also provided an opportunity for the team to look back on its preparation and competition experience: the challenges each member worked on, how responsibilities were divided, how decisions were made, and how different areas of expertise came together throughout the competition.

Through this reflection, three interconnected factors stood out behind the championship: (1) a technical foundation built through years of practical R&D and field experience, (2) the Red Team’s ability to turn individual expertise into coordinated execution, and (3) AI-assisted analysis that augmented the researchers’ problem-solving process.

(1) Technical Expertise – Built through R&D and Field Experience 

Through years of R&D and field research, AUTOCRYPT’s security researchers have continuously worked on automotive vulnerability analysis, attack scenario research, and emerging cybersecurity threats from both offensive and defensive perspectives. These experiences have built a technical knowledge base for approaching unfamiliar security challenges and analyzing automotive systems from an attacker’s perspective.

This expertise has also been strengthened through public-private automotive cybersecurity initiatives involving government and research organizations, including South Korea’s Ministry of Land, Infrastructure and Transport and the Korea Automobile Testing and Research Institute (KATRI). Such initiatives have provided opportunities to apply cybersecurity research into real-world automotive security challenges.

Yet in a competition where unfamiliar challenges had to be solved within a limited timeframe, technical knowledge was only the starting point. The next challenge was turning that knowledge into coordinated execution – bringing the second factor into play.

(2) Red-Team Capabilities – Turning Individual Expertise into Collective Strength

At DEF CON, this technical foundation was bought into action by AUTOCRYPT’s Red Team, bringing together different technical specialties and practical experience to turn individual expertise into a collective problem-solving capability.

Within the 50-hour competition window, the team had to rapidly analyze each challenge, determine priorities, allocate roles, and move from analysis to execution. Responsibilities were divided according to individual strengths, while hardware and software challenges in parallel and findings were continuously shared across the team. As new information and variables emerged, members adjusted their approaches and redirected resources accordingly.

Through this coordinated execution, the Red Team became the first to complete all challenges, demonstrating its ability to analyze complex hardware and software vulnerabilities, make rapid technical decisions, and coordinate offensive security capabilities under significant time constraints.

(3) Human-AI Collaboration – Accelerating Vulnerability Analysis

AI-assisted analysis further expanded the Red Team’s problem-solving capabilities. The workflow leveraged the complementary strengths of human researchers and AI agents, combining AI’s speed, scale and parallel processing with the context, validation and technical judgment provided by experienced security researchers.

During the competition, multiple AI agents worked in parallel to process large volumes of technical information, identify potential vulnerabilities and attack vectors, and explore possible approaches. Researchers then reviewed and assessed these findings to determine the relevance and the next course of action. This combination enabled faster and broader vulnerability analysis while keeping critical decisions in the hands of experienced researchers.

The competition therefore served as a practical demonstration of how AI-assisted analysis can be integrated into an expert-led offensive security workflow. Beyond the competition, this approach also provides a foundation for further developing human-AI collaborative methods for vulnerability research and security testing.

AUTOCRYPT aims to extend attacker-oriented research and vulnerability analysis into broader Physical AI environments, apply practical testing and offensive security expertise across autonomous systems, and further advance human-AI collaborative approaches for vulnerability identification, analysis and response.

Additional Resources

• Press Release: https://autocrypt.io/defcon34-ctf-winner/