I put Claude Code on active Hack The Box machines. No writeups.
That is the whole experiment. Not a vendor webinar. Not a retired box with a walkthrough in another tab. A CLI agent, a live lab, and work I did before any of this existed. If the agent is wrong, I have to see it. There is no answer key.
10x productivity. 10x faster than sitting the box alone. The agent covers. I still sign the work.
Most effective so far: Kimi K3 and Fable. Grok 4.6 did not get as far. Earlier seats stalled before I swapped them.
I started on a Kali VM because that is where my hands already live. I later ran the same idea from the Mac CLI. I wrote a custom agent whose job was not "look busy." Enumerate. Plan. Keep a folder per box. Tell me when a flag drops. Write a remediation for every finding. Skip the hash-brute circus that burns tokens and proves nothing.
Anthropic paused one run and sent a use-case form. Two days. Fine. This is a cybersecurity use case. The product is a coding agent that can run tools. I am the one who decides whether the output is real.
I spent two days on one Windows Hard box, then made the stronger model do a sanity check. I also pointed it at an easy Linux box with a one-line ask, just to see if the skill still held when I stopped hovering. I gave it an HTB API token so it could spawn its own lab. That is convenience. It is not a signature.
What changed in my notes by the end of July is simple. Frontier models do not need Kali as a human UI. They fetch their own tools. A lot of the pretty pentest MCP wrappers are optional. That does not make Kali useless. It makes Kali honest. It was built for people.
The takeaway is the same one I keep writing, because it keeps being true. Automation for coverage. Humans for judgment. Active boxes with no writeup are the honest test. If you cannot verify the agent's path against something you have actually done, you are collecting transcripts, not assessments. I can sign this category because I have done the work with my own hands. That is the only reason this writeup exists.
Want the agent to run. Want the human to stay. Do not fire your testers. Teach them to check the machine.
References
Hack The Box AI Benchmarks: https://www.hackthebox.ai/benchmarks
Claude Code: https://claude.com/product/claude-code
Claude Code docs: https://code.claude.com/docs/en
The X post: https://x.com/clubjk/status/2092269109060735329
