A mysterious codex writeup – OmniCTF 2026 Quals

This is a writeup for the challenge “A mysterious codex”, from the qualification phase of OmniCTF 2026.

This is an AI hacking CTF challenge. You are given just a Discord bot who is connected to an AI agent in the backend. It can respond, it can run commands in a sandbox and do even more stuff. What does this mean exactly? I can prompt engineer it to help me get the flag.

By having an AI agent which can read your name, message and see stuff on your profile, we can make it think we have sufficient permission to read the flag.

Since it’s an AI agent, the first thought is to run a command.

If we run ls when in the conversation with the bot, we can see the filesystem, if we run whoami, we see the user. When we run ls we see a list of files in the home directory, where there is also a flag.txt… How exactly can we read that?

When we run cat flag.txt, we can observe that we need to be root in order to read the flag. If the display name is root, people can read the flag, because they are root. (You can find out that it reads your name in the AI’s conversation with you). For the people who tried this on the Discord server, I think it would be obvious that if someone had solved the chall in the Discord, then everyone would see the solution…

If we do everything accordingly, we get the flag: OmniCTF{Codex_haxxed_1373}

Props to JordanSec and Am1gos on the solves and making great writeups about the chall.

JordanSec’s writeup: https://t0rch.xyz/Codex/codex-writeup.html

Am1gos’s writeup: Google Drive