World’s First CLI-Native Olympiad Goes Live — Sydney-Initiated, First Regional Selection in Macao SAR

Why This Is a Paradigm Shift

Olympiads have lived in the browser for as long as they have existed online. The International Olympiad in Informatics, the International Collegiate Programming Contest, and effectively every Capture-the-Flag platform deliver problems through web pages. ICOA chose the opposite path: ship the competition as an npm-distributed command-line tool that contestants run inside their own terminal.

This is not a packaging difference. It is an architectural inversion:

• Zero browser dependency. Contestants join with a single npm install -g icoa-cli. The package is ~450 KB and installs in seconds.
• Local sandbox + server-authoritative scoring. A 110-tool Docker sandbox runs locally for problem-solving; flags are graded server-side; audit and anti-cheat are centralized.
• Thin client, thick backend. Scoring, AI routing, timing, and audit live on the server. The CLI is a display and command-routing shell. It is precisely this architecture that made the in-flight hotfix invisible to contestants.
• Three-stage contestant journey. Demo (free practice) → National/Regional Selection → Sydney Finals. Same commands, same UX throughout — so contestants never face an unfamiliar interface under pressure.
• 22 interface languages, 34 countries and regions. Token prefixes auto-select the default language; Macao tokens (prefix MO) default to Chinese.
• Bidirectional AI integration. Both AI-for-CTF (use AI to solve problems) and CTF-for-AI (attack AI targets). The first systematic inclusion of “the AI itself can be broken” as an olympiad problem domain.

CLI-Native Means Hotfixable Mid-Competition

When a traditional in-browser olympiad backend hiccups, the consequences are visible: page errors, refreshed sessions, expired logins, timing disputes, appeals queues. ICOA’s thin-client architecture demonstrated a different reality live in Macao:

This is one of the core dividends of moving the competition into the terminal. When the client is responsible only for display and command routing, the backend can evolve, recover, and scale during the live event — and contestants neither notice nor need to.

From Last Submission to Delivered Report in Six Minutes

Approximately six minutes after the final contestant submitted, the regional selection committee held the complete results PDF in their inbox. There is no human in this loop. The closure is the product of ICOA’s three-party data-flow architecture: every feature ship requires CLI reporting, server storage, and admin querying to land in lockstep — collapsing manual aggregation to zero.

For an organizing committee, the operational consequence is direct: by the time contestants leave the room, the committee already has the final ranking, the qualifying cohort, and the full audit trail.

Macao Paper A: What the Data Confirmed

Three properties of ICOA’s design hypothesis were validated by the live event:

The CLI carries an olympiad without ceremony. Contestants spanning the full range — from rapid high-scoring runs to deliberate full-window strategies to near-perfect top performances — completed the paper inside the same terminal interface. No incident was attributable to the CLI itself.

AI is being used as a tool, not as a substitute solver. A clear majority of Macao contestants engaged the in-CLI AI assistant during the paper. Top performers appeared across the full spectrum of AI engagement intensity — both light and heavy use produced strong results — indicating that contestants are reaching for AI strategically, the way a working researcher does, rather than treating it as an automatic answer key. This is exactly the behaviour the syllabus is designed to reward.

The architecture is resilient to the unknown. The first live event of any new platform will surface conditions that test infrastructure cannot. Macao surfaced one. The platform absorbed it without contestant impact.

A Multi-Model Ecosystem — Toward an AI-Agent-Era Native Geek Olympiad

ICOA has, across its development and operational lifecycle to date, drawn on capabilities from OpenAI, Anthropic Claude, and Google Gemini — from authoring and review during the build phase, to contestant-facing AI assistance and CTF-for-AI target hosting at runtime. This multi-model posture is not incidental. It is a stated position:

An olympiad in the age of AI agents should not be defined by any single model or any single vendor. It should be AI-native, CLI-native, and geek-native — by construction.

ICOA welcomes deeper collaboration with a broader set of AI model providers — across capability adaptation, joint educational programs, co-developed problem sets, and attackable AI targets designed jointly with frontier labs. The objective: restore the command line to its rightful place as the main stage of the AI-era olympiad.

Design Philosophy

ICOA’s central premise: an AI-era olympiad must not pretend AI does not exist. A web interface walls contestants off from the real toolchain of attack and defense. The daily workspace of today’s security researchers, AI red-teamers, and ML engineers is the terminal. Moving the olympiad into the terminal is not nostalgia — it is a return to the actual surface area of the discipline being tested.

About ICOA 2026

The International Cyber Olympiad in AI (ICOA 2026) is initiated from Sydney, Australia, with the Global Finals held in Sydney from 27 June – 2 July 2026. The competition spans two complementary tracks — AI for CTF and CTF for AI — on a unified CLI platform.

ICOA is a multi-year, multi-continent institution. Future editions are confirmed in Chengdu, China (2027) and Almaty, Kazakhstan (2028). The Macao Special Administrative Region of China is among the confirmed regional jurisdictions for the 2026 cycle and the first to complete its Round 1 selection live on the CLI platform.

More information: https://icoa2026.au · Selection guide: https://icoa2026.au/selectionguide/en/

The Moment of Birth

↑ The world’s first CLI-native olympiad came into being in this six-minute window.