Hack The Box Autopilot Stats (Insane Windows)
HTB Autopilot: Season 12 week 4, an insane Windows box by ctrlzero. 4.5/5 from 122 reviews, 1,815 user owns, a two hour first blood. Live stats, spoiler-free.
Autopilot is week 4 of Hack The Box Season 12, an insane Windows machine by ctrlzero, worth 50 points and 1,365 XP. It went live at 19:00 UTC on 2026-10-17 and has been up for 11 days. What follows is the current data and a read of the difficulty. No chain, no flags.
HTB Autopilot at a glance
| Machine ID | 993 |
| Difficulty | Insane (50 pts / 1,365 XP) |
| OS | Windows |
| Released | 2026-10-17 (Season 12, week 4) |
| Status | active, 11 days live |
| Maker | ctrlzero |
| Rating | 4.5 / 5 from 122 reviews |
| User owns | 1,815 |
| Root owns | 1,590 |
| User → root drop | 12.4% |
| User blood | 2h 5m 48s by homerengue |
| Root blood | 2h 5m 48s by homerengue |
Community difficulty votes:
| Bucket | Votes | Share |
|---|---|---|
| Brain Fuck | 555 | 44.5% |
| Ex Hard | 194 | 15.6% |
| Too Hard | 155 | 12.4% |
| Hard | 137 | 11.0% |
| Cake | 44 | 3.5% |
Total votes: 1,246.
Is HTB Autopilot hard?
Yes, and the votes agree with the label more than they usually do. Brainfuck is the largest bucket at 44.5%, and with Extremely Hard and Too Hard added, 904 of 1,246 votes, 72.6%, put it above Insane. Weighted across the ten buckets it scores 82.3 out of 100. Two live boxes score higher: TrustFall at 90.8, also co-built by ctrlzero, and PingPong at 84.7. The 44 Cake votes are the usual handful of joke ballots on an Insane.
The first blood took 2h05m48s, the longest recorded blood on the live board. PingPong’s 1h11m29s is next, and TrustFall has no recorded blood at all. homerengue took user and root in the same second, so the API gives no gap between the two flags to read.
The 12.4% drop, 225 of 1,815 players stuck between user and root, is the widest of the four Insanes currently live. On TrustFall the filter was the foothold; on Autopilot a real share of the people who get in still stop short of root.
4.5 from 122 reviews is a well-liked Insane. ctrlzero has 14 machines on their profile, most of them Windows and most of them Hard or Insane: Timelapse, Outdated, Coder, Aero, DarkCorp, Mirage, Ghostlink, TrustFall and Autopilot on the Windows side. Autopilot is the second of three ctrlzero machines in a row, after TrustFall and before Takeoff, which went live on 2026-10-31.
What to have ready for Autopilot
- Plan for a multi-day box. Take structured notes from minute one. Insane boxes are lost to forgotten credentials far more often than to missing skills.
- Full AD groundwork as soon as anything authenticates: users, groups, ACLs, SPNs, certificate templates, then BloodHound. Assume every easy path is deliberately closed.
- Have pivoting working end to end before you start.
ligolo-ngorchisel, tested, so a second network does not cost you an evening. - Expect custom code or a service you have to read rather than look up. Insane boxes reward reverse engineering and patient primitive-chaining.
- Do not relax after user. The 12.4% drop says root is its own problem here, so carry the same discipline past the first flag.
When the Autopilot writeup lands
We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. Autopilot is still live, so the writeup goes up the week it retires, in the same format as the HTB Rebound one.
If you’d rather not wait, the team’s internal notes go out in our Discord first. That’s also where people work through active boxes together, which is the part you’re actually allowed to do while Autopilot is still live.
Related writeups
Retired insane Windows boxes we’ve already published: