CrowdStrike Offers $100K to Red-Team Rogue AI Agents

Learning Agent Security by Breaking Agents

There is a persistent gap in AI security training. Defenders read about prompt injection, nod, and go back to work — and then encounter it for the first time in production, which is the worst possible classroom. On August 5, 2026, CrowdStrike and Amazon Web Services announced a fix shaped like a game: AI Unlocked: Agents of Chaos, a $100,000 international red teaming challenge that has defenders attack AI agents in a controlled environment.

• $100,000 total prize pool, split across three acts
• Runs August 31 through September 29, 2026, with pre-registration open now
• Three acts: The Sanctum ($10,000, Aug 31-Sep 7), The Gatekeeper ($20,000, Aug 31-Sep 14), and The Basilisk ($70,000, Sep 15-29)
• Open internationally to anyone at the age of majority in their jurisdiction, with on-site play at Fal.Con 2026 in Las Vegas
• Built with AWS as collaborating partner

What Do Players Actually Do?

The premise is that players infiltrate a fictional adversary organization by manipulating its AI agents. The techniques are the real ones — prompt injection and related methods — and the missions are structured to demonstrate how agents can be exploited, how exploitation evades detection, and where runtime security controls fail.

The scoring design is the part I find genuinely clever. It combines puzzle solutions with token efficiency, and players can retry to optimize their approach. That rewards understanding the mechanism rather than brute-forcing it, because a scattershot attack that eventually works costs more tokens than a precise one. It is a scoring function that teaches the thing the exercise is meant to teach.

The three-act structure escalates, with the final act carrying $70,000 of the $100,000 pool and running its own two-week window after the first two close. That back-loading keeps the difficulty curve meaningful rather than letting early solvers coast.

Why Does Offensive Practice Make Better Defenders?

Because agent security fails in ways that are hard to reason about abstractly. A prompt injection is not a memory corruption bug with a clear boundary; it is text that looks like data until the model treats it as instruction. Reading a description of that leaves most people with a vague sense of unease and no mental model. Doing it once leaves them with a very specific one.

CrowdStrike's framing is that prompt injection, agent hijacking, and rogue AI behavior are not theoretical, and the training gap is real. Enterprises are deploying agents with tool access, credentials, and network reach faster than their security teams have developed intuitions for what that exposure looks like.

Structured, legal, sandboxed offensive practice has a long track record of closing that kind of gap — it is why capture-the-flag competitions became a fixture of security education in the first place. Applying the format to agentic AI is an obvious move that somebody had to make first.

How Does This Fit the Broader Defensive Picture?

It sits at the human layer of a stack that has been filling in quickly on the technical side. Runtime controls, agent identity, and access governance have all seen serious work this year, including CrowdStrike's own move to give AI agents verifiable identity with zero standing privilege and OpenAI's GPT-Red automating red-team discovery of injection failures.

Tooling without trained operators is shelfware, though, and that is the gap a competition addresses. If you are hardening real pipelines rather than playing, start with our guide to securing AI coding agents in CI — the controls it covers are exactly the ones players will be probing.

A $100,000 prize pool is a reasonable price for producing a cohort of defenders who have personally hijacked an agent and know what it felt like. More in our AI security coverage.

Sources: CrowdStrike — August 5, 2026; Security Boulevard — August 2026; Business Wire — August 5, 2026.