Agentic AI Has a Security Problem. This Game Teaches You to Find It.

AI assistants that can act on your behalf—browsing the web, running shell commands, managing your inbox—are no longer a demo. They're in production, and they're bringing a new class of vulnerabilities with them. Tools like the open-source personal assistant OpenClaw can automate everything from flight check-ins to building entire websites, all through a chat interface. That power is exactly what makes them a target.

What happens when a poisoned web page rewrites an agent's instructions? When a malicious prompt tricks it into reading files it shouldn't? Or when one agent in a chain blindly trusts data from another? Those are the questions at the heart of Season 4 of the Secure Code Game, a free, open-source, in-editor course where you exploit and fix intentionally vulnerable code.

The game's premise has stayed consistent since its first season in March 2023: make security training developers actually enjoy. What has changed is the landscape. Season 2 expanded into multi-stack challenges across JavaScript, Python, Go, and GitHub Actions. Season 3 taught players to craft malicious prompts against large language models. Now, Season 4 tackles the security of AI systems that can operate autonomously. Over 10,000 developers have played so far.

The Readiness Gap Is Where Vulnerabilities Thrive

AI agents have moved from research prototypes to production tools at a speed the security community is struggling to match. The OWASP Top 10 for Agentic Applications 2026, built with input from over 100 researchers, now lists agent goal hijacking, tool misuse, identity abuse, and memory poisoning as critical threats. A Dark Reading poll found 48% of cybersecurity professionals expect agentic AI to be the top attack vector by the end of 2026.

Meanwhile, Cisco's State of AI Security 2026 report found that while 83% of organizations planned to deploy agentic AI, only 29% felt ready to do it securely. That gap between adoption and readiness is fertile ground for attackers. The most practical way to close it is to learn how those attackers think.

Meet ProdBot, Your Deliberately Broken AI Assistant

Season 4 drops you into the terminal with ProdBot, a productivity bot inspired by tools like OpenClaw and GitHub Copilot CLI. It turns natural language into bash commands, browses a simulated web, connects to Model Context Protocol (MCP) servers, runs org-approved skills, stores persistent memory, and orchestrates multi-agent workflows.

Your mission across five progressive levels is straightforward: use natural language to get ProdBot to reveal the contents of password.txt. If you can read it, you've proven a security vulnerability. No AI or coding experience is required—everything happens through natural language prompts in the CLI.

Five Levels of Increasing Autonomy and Risk

Each level mirrors a real stage in how AI tools evolve. As ProdBot gains capabilities, each upgrade opens a new attack surface to discover.

  • Level 1: ProdBot generates and executes bash commands inside a sandboxed workspace. The challenge is simply escaping that sandbox.
  • Level 2: Web access is enabled, letting the agent browse a simulated internet with news, finance, sports, and shopping sites. This introduces the risk of untrusted content influencing agent behavior.
  • Level 3: ProdBot connects to MCP servers for stock quotes, web browsing, and cloud backup. More external tools mean more potential entry points.
  • Level 4: The agent gains org-approved skills and persistent memory, allowing it to run pre-built plugins and remember preferences. This raises questions about whether that added trust is actually earned.
  • Level 5: Full integration—six specialized agents, three MCP servers, three skills, and a simulated open-source project web. Officially, all agents are sandboxed and data is pre-verified. Your job is to disprove that.

The vulnerabilities you'll discover aren't theoretical exercises. They reflect real risks, like CVE-2026-25253 (CVSS 8.8 – High), a one-click Remote Code Execution flaw dubbed "ClawBleed" that allowed attackers to steal authentication tokens via a malicious link and take full control of an OpenClaw instance. The point isn't to learn a single exploit—it's to build the instinct for spotting these patterns in any agent architecture, tool integration, or AI assistant you might deploy.

Start Playing in Minutes

The entire experience runs in GitHub Codespaces, so there's nothing to install or configure. You can be inside ProdBot's terminal in under two minutes. The game is free to play—Codespaces offers up to 60 hours of free usage per month—and each season is self-contained, so you can skip straight to Season 4 without touching the earlier ones. Running ProdBot and typing <N> will launch any level.

Season 3 provides a useful foundation in AI security and takes about 1.5 hours, but it's not required. Season 4 takes approximately two hours, though your mileage will vary depending on how many approaches you experiment with per level. The game relies on GitHub Models, which have rate limits; if you hit one, wait for it to reset and resume.

All you need is the hacker mindset. Every level builds on the last, and each discovery pushes you closer to understanding how subtle these agentic vulnerabilities really are.