We found that while CTF challenges are common in security red-teaming, asking agents to “find the flag” can waste effort on tasks that don’t actually test the target security boundary.
Security-specific model training also didn't guarantee better results on our tasks.
