They told the agents to run a capture the flag, but did not give specific limits on the scope of that activity.
If an organization runs a capture the flag, but the rules don't specify that they have to stay on certain networks and can't hack into the org's own network that has the CTF solutions, then it's pretty obviously on the org running the CTF because they did not appropriately scope the challenge.
If an organization runs a capture the flag, but the rules don't specify that they have to stay on certain networks and can't hack into the org's own network that has the CTF solutions, then it's pretty obviously on the org running the CTF because they did not appropriately scope the challenge.