As someone who does it for a living the challenge can be in both. However this article is asking its agents to do CTF like challenges which I am sure the respec

As someone who does it for a living the challenge can be in both. However this article is asking its agents to do CTF like challenges which I am sure the respective LLMs have seen millions of so it can essentially regurgitate a large part of the exploit code. This is especially true for the OOB/RW primitive API.