I gave this talk at the BRAIN AI Applications and Tooling Meetup at the Ballarat Hackerspace on 10 June 2026. I wanted to introduce LangChain, as a means to building custom agents in Python. I’ve been coding with it for a client project for a while now, which has allowed me to do things that aren’t easy to do with a standard agent: things like validation, cross-source checking, and so on, while doing the “main” thread.

This was the grand finale - a physical hardware challenge where teams had to cut real wires under time pressure. I wanted the CTF to end with something you can’t do at home behind a keyboard, something that gets your heart rate up.

I have a strong interest in AI, and wanted a challenge that did AI prompt attacks, and I wanted teams to get hands-on experience with it.

I wanted this challenge to show that two-factor authentication isn’t a silver bullet. Trevor Blackwood’s webmail is protected by TOTP-based 2FA, but the implementation has multiple flaws that let you bypass it entirely.

This was the biggest challenge in terms of flag count - eight flags across easy, medium, and hard tiers. I wanted to build a realistic company website with layered vulnerabilities that rewarded both breadth (finding many issues) and depth (chaining exploits together).