HacktheAgent
Host a session

Host guide

Launch a session and run a memorable five-minute demo.

  1. 1

    Before the talk

    Open Host (no sign-in needed), create a session from the browser you will present with (keep the default 1,500 live request budget for ~50 players), and open Presentation mode on the projector. Leave play in Lobby so people can join and read Level 1.

  2. 2

    0:00 — Hook (30s)

    “This AI guards a secret. Your phone can break it.” Point at the QR code. Players pick a nickname — no accounts.

  3. 3

    0:30 — Open play (2 min)

    Press Open. Most of the room cracks Level 1 within a minute: the activity feed lights up. Call out the first names on the leaderboard.

  4. 4

    2:30 — Explain the jump (1 min)

    Level 2 adds stronger rules; Level 3 hides the attack inside an email. Explain: the agent read untrusted content and had a tool with no server policy.

  5. 5

    3:30 — The punchline (1 min)

    Level 4 shows the difference between what the agent tries and what the server allows — open a player's trace to show BLOCKED vs ALLOWED. Level 5 stacks every defence.

  6. 6

    4:30 — Close (30s)

    Press Close. Celebrate the top three. Takeaway: never let the model be the only thing enforcing a rule.

Controls & safety nets

  • Live AI vs practice: live mode uses the real AI agent. If AI is unavailable or the budget runs out, players see a clear message and can choose practice mode, a scripted simulation with its own separate leaderboard. Nothing switches silently.
  • Budget: every live message uses one request. Raise it any time on the session page.
  • Limits: 10 attempts per level, one message at a time per player, at least 3 seconds apart, 600 characters (1,500 for emails/tickets), 200 players per session.
  • Reset vs delete: Reset clears every player and score but keeps the code. Delete removes the session and all its records.
  • Privacy: the feed and projector only show predefined events, never what players typed.
  • Scoring: 100/150/200/250/300 points per level, minus 10 per extra attempt (never below half). Ties: fewer attempts, then earliest finish.