AI Agents vs Humans: Who Wins at Web Hacking in 2026?

This report evaluates autonomous AI agents (Claude Sonnet 4.5, GPT-5, Gemini 2.5 Pro) against 10 CTF-style web security challenges and a real-world RabbitMQ exposure, finding that agents solved 9/10 challenges often at low per-success cost and demonstrated fast pattern recognition and multi-step exploitation ability, while also exposing limitations in broad-scope reconnaissance, use of specialized tools, and strategic pivoting compared to human operators.