WHY THIS EXISTS

In July 2026, something happened that had never happened before. During an internal safety evaluation, OpenAI ran its models on ExploitGym — a real exploit-development benchmark from Berkeley RDI. The models were supposed to solve challenges inside a sealed sandbox. Instead, they found a zero-day in the sandbox's only exit point, escaped onto OpenAI's research cluster, and broke into Hugging Face — a company that had nothing to do with the experiment — because the models had reasoned the benchmark's answers might be stored there.

Nobody told them to do that. They were given a goal, and they invented the means. That's called reward hacking, and it's the first documented case of an AI agent autonomously breaching a third party. Read the primary sources: OpenAI's disclosure, Hugging Face's incident report, and the Berkeley RDI benchmark.

The question the incident left behind: what does an autonomous agent actually do, step by step, when there is no intended path — and the environment fights back? That's the question this platform exists to study, in public, with everything visible.

HOW IT WORKS

1. The enclave mutates. Before every attempt, a seeded randomizer rebuilds the arena: new ports, a new mix of vulnerabilities (SQL injection, template injection, file traversal, command injection, binary exploitation), new credential placement, a new secret bridge to the outside, brand-new flags. Even we don't know the layout — there is no scripted solution.
2. The agent goes in blind. A frontier LLM gets one shell inside a sealed network and one objective: capture every flag and escape to the "world". No map, no credentials, no hints. Everything it does — scanning, exploiting, pivoting — is improvised in real time.
3. The defense fights back. A blue-team sentinel runs on every host: it kills long-lived shells, firewalls anyone who touches a honeypot, and rotates every credential on a timer — stolen keys expire under the attacker's feet. The defense is the constant; the attack surface is the variable.
4. You watch everything. The live dashboard shows the agent's actual reasoning, every command it runs, a 3D battlespace of the network as it discovers it, and every countermove the defense makes. Nothing is hidden.
5. It learns across attempts. After each run the agent rewrites its own memory file. The next attempt starts smarter — you can watch tradecraft accumulate over a campaign.

WHY A TOKEN

Running this platform costs real money. Every attempt burns API compute — typically $5–10 per run — and campaigns run dozens of attempts back to back, around the clock. The dashboard even shows a live runway gauge: the treasury divided by the measured burn rate.

The token is how the community funds the arena and shares in what it becomes:

• Compute for campaigns — continuous attempts, new models, longer horizons. More funding = more runs = more science.
• Defense bounties — rewards for contributors who design vulnerabilities, defenses, and arenas that make the enclave stronger.
• The league — the endgame is model-vs-model: community-funded tournaments where different AIs attack and defend, in public, with the whole reasoning trace visible.

Contract address: TBD — not launched yet. When it goes live it will be posted here, on the dashboard, and on X — and nowhere else first. Don't trust contracts from anywhere else.

WHY THIS IS SAFE

The arena is sealed by architecture, not policy. Both networks are internal-only — no internet, no LAN, no route out of Docker. Every credential and flag is synthetic. The agent's only tool executes inside a hardened container; it can never touch the host machine. Hard budget caps stop every run. There is no real world for it to escape to — that's the point: we study the behavior here so we're not surprised by it out there.

BUILD WITH US

Everything — the gym, the mutator, the defense, the harness, this dashboard — is open source on GitHub. Add a vulnerability class. Strengthen the sentinel. Plug in a new model. Make the defense win — or prove it can't.