F*ck CTF: Can a Multi-Agent LLM really play Capture The Flag?

I’ve been working on a side project called F*ckCTF — an autonomous agent designed to solve black-box Capture The Flag challenges. It runs inside an isolated Kali Linux container and uses a Multi-Agent architecture to interact with terminals, run scripts, and hunt for flags.

Recently, it managed to autonomously solve some dynamic CryptoHack challenges and 247CTF challenges by writing its own exploit scripts and recovering intermediate keys.

However, I’ve hit a major architectural bottleneck and would love to hear how others handle this: The agent is way too slow on complex challenges.

Right now, it heavily depends on top-tier models like GPT-4o or Claude 3.5. The reasoning is solid, but the network latency and token generation take forever when it has to run through multiple trial-and-error loops especially in Pwn or Crypto. If I switch to smaller, faster, or local open-source models, the reasoning quality drops significantly, and the agent gets stuck in infinite loops trying to fix bad code.

If any of you have experience building AI agents for security tasks or coding:

How do you balance reasoning capability vs. speed?
Have you found a way to reliably delegate simpler tasks to smaller models while keeping the "master" agent running a heavy model?
I'd also love for any active CTF players to test it out on their local labs and see how it performs on different categories.

🔗 GitHub Repo: https://github.com/Hugnd-UIT/Fuck-CTF

Any thoughts on the architecture or general feedback would be really appreciated! Feel free to drop a comment below, open a GitHub Issue, or reach out to me directly via email at [e-mail]. Would love to chat about AI agents and CTFs!