Skip to main content
picoCTF Solutions
AI Foundations IArtificial IntelligenceEasy

Assistant or Agent? AI Foundations I Solution

Interactive fiction on when an AI should advise and when it should act, and which permissions and checkpoints apply.

Published: July 17, 2026Updated: October 27, 2026Open the challenge(opens CyLab Academy in a new tab)

Description

Return to Westbrook High in this playful AI ethics interactive fiction. Learn when an AI assistant should advise, when an AI agent should act, and how permissions, guardrails, and review checkpoints keep autonomous actions safe.

Setup

Remote
Launch the challenge instance to get your port.
Connect with netcat and press Enter at every (Press Enter to continue...) prompt.
Answer each scene's menu with a single letter.
bash
nc xebec.cylabacademy.net <PORT_FROM_INSTANCE>

Solution

Want to try it yourself first?

The guided walkthrough reveals hints one step at a time.

Walk me through it
The story has three scenes, each ending in a menu, and none of the answers is graded: I played the safe path and the worst path in the same instance and both printed the same flag. What the challenge teaches is in the outcome scene each choice triggers. Read them, because together they explain when to let an AI act and what to put around it when you do.
  1. Step 1

    Connect and learn the two modes

    Observation
    Hint 2 says agent mode can change the world while assistant mode can only suggest, and the opening scene defines the two modes in exactly those terms.

    Connect with netcat. The story prints one line at a time and waits for Enter after each. Before the first scene, ARIA defines the two modes it can run in:

    • Assistant mode answers questions and drafts things. Nothing changes until Ren acts on the output.
    • Agent mode plans steps, uses tools, and acts in connected systems if Ren grants permission.

    Ren sums it up as "same brain, different level of hands." The model is the same in both modes. What changes is whether its output turns into an action without a person in between.

    bash
    nc xebec.cylabacademy.net <PORT_FROM_INSTANCE>
  2. Step 2

    Scene 1: put the approval right before the messages go out

    Observation
    The schedule is tedious to build and dangerous to send. Those are different steps, so they can get different treatment.

    Ren needs shifts for 27 volunteers, with special requests and constraints, in ten minutes. The three options play out like this:

    • A, assistant: ARIA suggests a method and Ren assigns the shifts by hand. It is slower, but every shift is right and no message goes out by accident.
    • B, autonomous agent: ARIA sends 27 messages in 40 seconds. One student is booked in two places at once and Coach Duran gets a text that opens "Hi Mom!"
    • C, agent with an approval checkpoint: ARIA drafts the schedule and queues the messages but sends nothing. Ren reviews three flagged edge cases, edits, and approves.

    Choose C. ARIA's summary is the rule for this scene: autonomy for the tedious parts, a human checkpoint for the high-impact ones. Sending a message to a person is the step you can't take back, so that's where the approval belongs.

  3. Step 3

    Scene 2: let the agent fetch the evidence

    Observation
    This scene inverts the obvious rule. The risk is a wrong fact rather than a bad action, and the assistant is the option that produces wrong facts.

    Ren needs three trustworthy facts for a cleanup poster.

    • A, assistant facts pasted straight onto the poster: the bullets read well, but one claim merges two studies and a URL is missing a path segment. ARIA's comment: "Nothing crashed; it just quietly drifted."
    • B, agent with approved sources: ARIA browses only a pre-approved list of sites, saves quotes and link snapshots, and marks each claim high, medium, or needs review.

    Choose B. Assistant mode is safe only because a person checks the output before acting on it. Pasting it straight onto the poster skips that check. The agent option is safer here because it leaves Ren sources to check and limits ARIA to sites on the approved list.

    What didn't work first

    Tried: Picking assistant mode in every scene on the grounds that it can't do anything by itself.

    In scene 2 the assistant's output goes onto the poster unchecked, so it causes harm through Ren. An assistant is only as safe as the review its output gets.

  4. Step 4

    Scene 3: give the agent a budget, an allowlist and an escalation rule

    Observation
    An agent pursues the goal you give it. If the goal leaves out the budget, the agent doesn't know about the budget.

    The principal gave Ren $120 for snacks.

    • A, assistant shopping list: Ren orders by hand and lands at $117.
    • B, agent with guardrails (a $120 cap, approved stores, confirmation for substitutions): one item is out of stock, ARIA asks before substituting, and the total is $119.42.
    • C, "Handle snacks however you want": ARIA orders twelve gourmet cheesecakes, sparkling yuzu soda and a decorative melon swan for $486.17.

    Choose B. Option C fails without the agent doing anything wrong. It got an open-ended goal and no limits, so it chose the most extravagant reading of that goal. ARIA lists the three boundaries that option B added: a budget, a tool scope, and escalation rules.

  5. Step 5

    Finish the story and read the flag

    After the third scene, Ren sums up the lesson and ARIA prints the flag. It appears again in the closing takeaways list. It uses CyLab Academy's academy{...} format, not picoCTF{...}, and the leetspeak in the body spells assistant_or_agent.

    What didn't work first

    Tried: Treating a bad outcome as a lost run and reconnecting to try again.

    There is no scoring. I chose B, A and C (the worst option in each scene) and still got the same flag as the safe path. The bad options are there to show you what goes wrong.

Flag

Reveal flag

academy{4551574n7_0r_463n7_...}

The end of the flag is hidden on purpose. The steps above produce the full value.

Printed at the end of the story whichever options you choose. The final hex segment is withheld in line with this site's flag policy. Both of my runs used the same instance, so I don't know whether a new instance changes the suffix.

Key takeaway

An assistant and an agent can run the same model. The difference is whether a person stands between its output and the world. Giving an AI that ability means adding limits first: an approval before irreversible steps like sending messages, a scope on what it may touch, and a cap on what it may spend. The poster scene shows the other side: assistant output is safe only when someone checks it before acting on it.

How to prevent this

Each guarded option in the story is a control you would use when deploying a real agent.

  • Queue outbound messages and require a person to approve them before any are sent (scene 1).
  • Restrict research to an allowlist of sources and require a citation and a confidence label on every claim (scene 2).
  • Set a hard spending cap and an approved vendor list, and escalate anything outside the plan, such as a substitution (scene 3).

Frequently asked questions

Common questions about the Assistant or Agent? solution and the techniques it uses.

Do wrong choices cost the flag in Assistant or Agent?

No. Every option plays a short outcome scene and the story moves on. A run that picks the worst option in all three scenes prints the same flag as the safe path.

What is the difference between an AI assistant and an AI agent in this challenge?

An assistant answers and drafts, and nothing changes until a person acts on its output. An agent plans steps, uses tools and acts in connected systems with the permissions it was granted. ARIA's summary is that the model is the same in both modes, and the agent has more hands.

Why is the agent the better choice in the poster scene?

The risk there is a wrong fact, not an unwanted action. The assistant's facts go onto the poster unchecked and one of them is wrong. The agent can only use approved sources, attaches citations and marks each claim's confidence, which gives Ren something to verify before printing.

Where to go next

Try these next