Astra swarm workflows cracked DEF CON puzzles

Astra solved three DEF CON puzzles Ben Davis and his team could not, plus one no team in the world had solved. The difference was Astra's swarm workflows.

According to OpenAI's YouTube channel, Davis is a DEF CON regular who spent days on the contest with friends. He threw the hardest challenges at the model to see if it was actually new.

The full discussion can be found on OpenAI Youtube's YouTube channel.

One was a 3 by 4 grid of Rubik's cubes hiding a message. Astra solved it three out of three tries.

Another was a dress covered in multicolored beads, photographed badly across many images. The model had to see and connect details across those disparate shots to pull out the message.

Both puzzles needed the official hint from the creators. That part matters. It's the same hint humans got, but Astra is not solving cold.

How the solve actually works

Think of a lead detective with ten junior investigators on call. The lead forms a theory, sends an agent to test it, and branches the research based on what comes back.

Astra runs that way. A main agent orchestrates up to 10 sub-agents in parallel. Each slot can chase a different hypothesis while the main keeps score.

The usual failure mode in puzzles is drift. You go from a start word to an end word with no verification in between, and one bad assumption sends you down a dead path.

Davis said Astra is much better at not getting lost. It holds the task and prunes bad branches instead of disappearing into them.

What this means for security teams, and what still falls short

DEF CON CTF puzzles are a proxy for real security work. They test visual reasoning, pattern extraction, and the ability to stay coherent across messy inputs.

If a model can do that with a single hint, any team that relies on puzzle-like obscurity or scattered evidence is exposed. You can now automate the grunt work of trying theories in parallel.

The limit is also clear. No hint, no solve in these examples. And the demo was local puzzle files, not remote exploitation against live systems.

Builders should treat swarm orchestration as the pattern to watch. Single-agent prompting won't match ten agents testing in parallel, and evaluation should assume attackers will try that.

Without the hint, Astra still needed guidance. That's where defenses still have room.