If you're a serious CTF player or challenge solver, you've probably heard of BrownOS.
For years, it carried a reputation as one of the hardest challenges on WeChall. Minimal documentation, a maximum difficulty rating of 10, and a solve count so low that many players took one look at it and decided their time was better spent elsewhere.
I was one of them.
BrownOS sat in my "I'll do it when I have infinite free time" bucket for years. It belonged to that category of challenge that experienced players respect from a distance. The kind of challenge that quietly accumulates mythology because almost nobody finishes it.
Then, recently, I decided to stop postponing it.
Not because I suddenly found infinite free time.
Quite the opposite. I wanted to answer a different question.
Over the last few years, I have spent a significant amount of time experimenting with AI systems. Like many people in cybersecurity, I've watched the conversation swing between two extremes.
One side claims AI is overhyped. The other claims AI will replace everyone.
Both positions struck me as unsatisfying.
The interesting question isn't whether AI is magical or useless.
The interesting question is what happens when highly capable humans begin working alongside increasingly capable machines.
BrownOS turned out to be an ideal test case.
Solving a Challenge from Another Era
When BrownOS was created, the modern AI ecosystem simply did not exist.
There was no ChatGPT. No Claude. No Gemini. No Grok.
No workflow where a single researcher could simultaneously interact with multiple reasoning systems, generate tooling on demand, rapidly prototype ideas, and explore unfamiliar technical territory with machine assistance.
The pioneers who solved BrownOS operated under a completely different set of constraints.
They had debuggers, documentation. A lot of patience.
And a willingness to spend an enormous amount of time banging their heads against difficult problems.
My workflow looked very different.
I approached the challenge with a collection of LLMs, custom tooling, and a willingness to treat the entire solve as an experiment.
What surprised me wasn't that the models were useful. That part was obvious.
What surprised me was how useful they were.
Tasks that previously would have consumed a full day frequently collapsed into hours.
The models helped explain obscure concepts, generate tooling, review approaches, challenge assumptions, and accelerate iteration.
In many cases they behaved like tireless research assistants.
Not brilliant researchers. Not autonomous problem solvers.
Research assistants.
Fast, tireless, occasionally insightful, occasionally wrong, and always available.
The productivity gains were impossible to ignore.
What AI Actually Changed
One mistake I frequently see in discussions about AI is that people focus on outcomes instead of workflows.
The question is usually framed as: "Can AI solve the challenge?"
That is increasingly the wrong question.
A better question is: "How does AI change the process of solving the challenge?"
BrownOS provided a useful answer.
The models did not simply hand me the solution.
They did not replace the need for technical expertise.
They did not eliminate the need for persistence.
What they changed was the cost of exploration.
Ideas became cheaper. Experiments became cheaper.
Dead ends became cheaper. Investigation became cheaper.
The challenge itself remained difficult.
But the cost of attacking the challenge dropped significantly.
That distinction matters.
Cybersecurity is not becoming easier.
The economics of cybersecurity are changing.
Where AI Helped, And Where It Didn't
One of the more interesting observations was where the models succeeded and where they struggled.
They excelled at mechanical acceleration: tool generation, rapid implementation, exploration of alternatives, documentation, code review, knowledge retrieval.
The areas where progress slowed were different.
The final breakthrough did not emerge because the models generated more code.
It emerged because the problem itself was reframed.
The solution required stepping back from the current line of attack and viewing the underlying structure differently.
Perhaps future models will become significantly better at that.
Perhaps they won't.
Predicting AI capability even two years into the future has become a dangerous game.
What matters is what happened during this particular solve.
AI dramatically accelerated the journey.
The decisive breakthrough still came from changing the perspective from which the problem was viewed.
The Bottleneck Is Moving
This is the observation I keep returning to.
The bottleneck is moving.
Historically, a significant portion of technical work involved translating ideas into implementation: writing code, building tools, performing repetitive analysis, executing investigations.
Machines are becoming increasingly capable of assisting with those activities.
As a result, the scarce resource is shifting.
Less time is spent producing artifacts.
More time is spent deciding what should be produced.
Less time is spent executing.
More time is spent directing.
Less time is spent writing code.
More time is spent deciding where to look.
This is not unique to cybersecurity.
It is happening across many technical disciplines simultaneously.
An Interesting Coincidence
After a few weeks of struggle, I finally became the fifth BrownOS solver.
That achievement was satisfying.
But something else caught my attention.
For twelve years, BrownOS had accumulated only four solvers.
Then additional solves began appearing.
One data point proves nothing.
A handful of solves proves very little.
Still, it raises an interesting question: How many challenges that once required months of effort from a small group of specialists become accessible when every capable practitioner gains access to machine-scale assistance?
We are only beginning to find out.
BrownOS as a Time Capsule
In retrospect, BrownOS felt less like a challenge and more like a time capsule.
It was designed for a world that no longer exists.
A world where every difficult step required direct human effort.
A world before modern reasoning systems.
A world before AI-assisted research workflows.
And yet the challenge remains valuable because it allows us to compare those two eras directly.
The challenge didn't change.
The solvers did.
The tools did.
The workflow did.
The economics did.
That makes BrownOS more than just a difficult puzzle.
It becomes a lens through which we can observe a broader transition taking place across the industry.
Final Thoughts
The interesting question is no longer whether AI can help solve hard challenges.
It can.
The interesting question is what challenge solving looks like when every serious player has access to a small army of machine reasoning systems.
We are still early enough that nobody knows the answer.
What I do know is this:
BrownOS was designed for a different era.
Solving it with a workflow from the future was almost as interesting as the solve itself.
