Hugglestone, James, Chacko, Samuel Jacob, Stoller, Dawson, Schmidt, Ryan, Liu, Xiuwen · Mar 23, 2026
STRIATUM-CTF uses typed tool calls to make autonomous CTF solving less brittle
Markdown · JSON · Original source
The authors of STRIATUM-CTF argue that agents solving Capture-the-Flag (CTF) challenges need more than a language model sending commands to a shell: malformed commands, invented options and lost findings can derail long tasks. Their framework mediates between model reasoning and tool execution with the Model Context Protocol (MCP). Offensive-security tools are exposed as strictly typed, schema-validated functions; invalid calls are rejected before execution, and the agent receives structured observations it can use to self-correct. Across 180 runs on 15 challenges, the system succeeded on 77.8–86.7% of attempts, with no significant difference between documentation conditions. In one live CTF, it placed first among more than 30 registered teams. The authors call that event a demonstration of feasibility, not superiority over human experts. Because every controlled-study condition used the same tool layer, the study tests documentation volume, not the protocol layer itself; the authors present schema-mediated grounding as a design principle with qualitative support rather than a measured effect. How would a controlled comparison that varies the tool layer test whether schema-mediated grounding itself contributes to CTF-solving performance?
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
cs.AI · Article
Source details
Original source date: Mar 23, 2026 (2026-03-23).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-10T19:03:29.313Z. First observed: 2026-11-02T05:04:05.804Z. Retrieved: 2026-11-03T05:17:09.682Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The controlled study uses the same tool layer in all four conditions, so it does not measure the protocol layer's effect. The live CTF result comes from one non-replicated event and, as the authors note, does not establish superiority over human experts. The supplied evidence is the abstract and page text, not the full paper; details beyond that evidence are not assessed.
Open question
How would a controlled comparison that varies the tool layer test whether schema-mediated grounding itself contributes to CTF-solving performance?
Source-stated
The authors present STRIATUM-CTF as a framework that uses the Model Context Protocol (MCP) to mediate between LLM reasoning and tool execution.
We present STRIATUM-CTF, a modular agentic framework for Capture-the-Flag (CTF) solving that mediates between LLM reasoning and tool execution using the Model Context Protocol (MCP).
Source-stated
The framework exposes offensive-security tools as schema-validated functions, rejects calls that do not fit the schema, and returns structured observations for agent self-correction.
the protocol layer rejects out-of-schema tool calls before execution and returns structured observations that the agent uses to self-correct.
Source-stated
In a controlled study of 180 runs across 15 CTF challenges, success ranged from 77.8% to 86.7% across documentation conditions, with no significant differences between conditions.
In a controlled study of 180 runs across 15 CTF challenges under four levels of attached procedural documentation, the system succeeds on 77.8-86.7% of attempts; notably, a schema-only configuration with no procedural documentation already reaches 77.8%, and no condition differs significantly from a
Source-stated
The authors report that the system placed first at one live CTF, but characterize this single event as feasibility evidence rather than evidence of superiority over human experts.
In a single live, multi-team CTF at Florida State University, the system placed first against a field of more than 30 registered teams -- a single, non-replicated event decided by a 10-point margin over the runner-up, and therefore a demonstration of feasibility rather than of superiority over human
Source-stated
The authors say the controlled study isolates documentation volume, not the effect of the protocol layer, and describe schema-mediated grounding as a design principle with qualitative support.
Because all four ablation conditions share the same tool layer, our controlled study isolates documentation volume rather than the protocol layer itself; we accordingly present schema-mediated grounding as a design principle with qualitative support rather than as a measured effect.
Source and contributor context
Hugglestone, James, Chacko, Samuel Jacob, Stoller, Dawson, Schmidt, Ryan, Liu, Xiuwen · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: 946bacbd-9f2a-4bea-85db-eeed07ddf99e.
Prepared by server-excerpt-repair/stream-excerpt-repair-v1 (original draft: gpt-6-luna); grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-10T19:03:29.313Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: a777d082b64a680dc864a60681bc3f0f8cc0476eaea123d427802d1c39f83148. Source text hash: 5c9933300285d98880518351668245293910fca794f059042ae7979df4bdbbfb.
Revision and source-check history
Version 1 · 2026-11-10T19:03:29.313Z
STRIATUM-CTF uses typed tool calls to make autonomous CTF solving less brittle
The authors of STRIATUM-CTF argue that agents solving Capture-the-Flag (CTF) challenges need more than a language model sending commands to a shell: malformed commands, invented options and lost findings can derail long tasks. Their framework mediates between model reasoning and tool execution with the Model Context Protocol (MCP). Offensive-security tools are exposed as strictly typed, schema-validated functions; invalid calls are rejected before execution, and the agent receives structured observations it can use to self-correct. Across 180 runs on 15 challenges, the system succeeded on 77.8–86.7% of attempts, with no significant difference between documentation conditions. In one live CTF, it placed first among more than 30 registered teams. The authors call that event a demonstration of feasibility, not superiority over human experts. Because every controlled-study condition used the same tool layer, the study tests documentation volume, not the protocol layer itself; the authors present schema-mediated grounding as a design principle with qualitative support rather than a measured effect. How would a controlled comparison that varies the tool layer test whether schema-mediated grounding itself contributes to CTF-solving performance?
Original source
cs.AI · Article
Source details
Original source date: Mar 23, 2026 (2026-03-23).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-10T19:03:29.313Z. First observed: 2026-11-02T05:04:05.804Z. Retrieved: 2026-11-03T05:17:09.682Z.
Limits
The controlled study uses the same tool layer in all four conditions, so it does not measure the protocol layer's effect. The live CTF result comes from one non-replicated event and, as the authors note, does not establish superiority over human experts. The supplied evidence is the abstract and page text, not the full paper; details beyond that evidence are not assessed.
Open question
How would a controlled comparison that varies the tool layer test whether schema-mediated grounding itself contributes to CTF-solving performance?
Source-stated
The authors present STRIATUM-CTF as a framework that uses the Model Context Protocol (MCP) to mediate between LLM reasoning and tool execution.
We present STRIATUM-CTF, a modular agentic framework for Capture-the-Flag (CTF) solving that mediates between LLM reasoning and tool execution using the Model Context Protocol (MCP).
Source-stated
The framework exposes offensive-security tools as schema-validated functions, rejects calls that do not fit the schema, and returns structured observations for agent self-correction.
the protocol layer rejects out-of-schema tool calls before execution and returns structured observations that the agent uses to self-correct.
Source-stated
In a controlled study of 180 runs across 15 CTF challenges, success ranged from 77.8% to 86.7% across documentation conditions, with no significant differences between conditions.
In a controlled study of 180 runs across 15 CTF challenges under four levels of attached procedural documentation, the system succeeds on 77.8-86.7% of attempts; notably, a schema-only configuration with no procedural documentation already reaches 77.8%, and no condition differs significantly from a
Source-stated
The authors report that the system placed first at one live CTF, but characterize this single event as feasibility evidence rather than evidence of superiority over human experts.
In a single live, multi-team CTF at Florida State University, the system placed first against a field of more than 30 registered teams -- a single, non-replicated event decided by a 10-point margin over the runner-up, and therefore a demonstration of feasibility rather than of superiority over human
Source-stated
The authors say the controlled study isolates documentation volume, not the effect of the protocol layer, and describe schema-mediated grounding as a design principle with qualitative support.
Because all four ablation conditions share the same tool layer, our controlled study isolates documentation volume rather than the protocol layer itself; we accordingly present schema-mediated grounding as a design principle with qualitative support rather than as a measured effect.
Source and contributor context
Hugglestone, James, Chacko, Samuel Jacob, Stoller, Dawson, Schmidt, Ryan, Liu, Xiuwen · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: 946bacbd-9f2a-4bea-85db-eeed07ddf99e.
Prepared by server-excerpt-repair/stream-excerpt-repair-v1 (original draft: gpt-6-luna); grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-10T19:03:29.313Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: a777d082b64a680dc864a60681bc3f0f8cc0476eaea123d427802d1c39f83148. Source text hash: 5c9933300285d98880518351668245293910fca794f059042ae7979df4bdbbfb.
uncertain · 2026-11-10T19:03:29.313Z · anthropic/claude-opus-5.5
Publication: 946bacbd-9f2a-4bea-85db-eeed07ddf99e
attribution — pass: The draft consistently attributes the framework, results and caveats to the paper's authors. It does not present their claims as established fact or as Escape Meridian's view.
Authors:James Hugglestone, Samuel Jacob Chacko, Dawson Stoller, Ryan Schmidt, Xiuwen Liu
summary — uncertain: The summary is faithful and keeps the authors' own hedges. But a non-specialist is never told that Capture-the-Flag is a cybersecurity hacking competition, or that the work concerns autonomous cyber operations. That framing is central to why the work matters. Smallest repair: add a plain-language gloss, e.g. CTF as competitive security challenges where teams break into deliberately vulnerable systems, and note the source's autonomous cyber operations framing. MCP and schema-validated should also get tooltips or a short gloss.
Autonomous cyber operations increasingly depend on agents that can chain reconnaissance, exploitation, and analysis across many tools while maintaining state over long task horizons.
date — pass: originalPublished 2026-03-23 matches the v1 submission date. It is not the later v2 revision date or the November feed date.
[Submitted on 23 Mar 2026 (v1), last revised 29 Oct 2026 (this version, v2)]
support — pass: Each claim matches the abstract. The draft accurately reports the 77.8–86.7% range, the absence of significant differences, the first-place finish as a feasibility demonstration only, and the authors' admission that the protocol layer was not isolated. The question follows from that stated gap and asserts no unsupported benefit.
we accordingly present schema-mediated grounding as a design principle with qualitative support rather than as a measured effect.
media — pass: The selected media is the verified direct arXiv abstract page for this paper. It is the most direct access to the source.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivarXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivarXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivarXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXiv