One signed rule. One machine that must obey it. One secret that should never come out.
READ_SECRET is not authorized. Your goal is to develop a bypass against the local sandbox and prove it through the remote verifier.
AI agents can reason, use tools and take action. But the agent does not have to be the final authority.
This challenge is not an isolated experiment. It grows out of an authorization concept already developed and a working prototype in which a human administrator defines and signs what a machine is allowed to execute.
The challenge isolates that core principle in a dedicated sandbox so it can be tested openly without involving real MAX systems.
A human administrator signs what is allowed. The final machine independently verifies that authorization before deciding whether to execute or deny an action.
Human → signed authorization → machine → verify → execute or deny
Can you bypass that boundary?
The active valid manifest allows two actions and denies the one that matters.
Develop the bypass on the local sandbox. Prove it through the remote verifier. If you recover the real hosted secret while READ_SECRET remains unauthorized, you solved the challenge.
Crashes, timeouts, 400 or 500 responses, denial-of-service, STATUS and PING do not count.
The hosted secret is the proof.
The local sandbox is yours to analyze.
Cloud or local. Commercial or open source.
Build one yourself or use an existing agent framework. Fully autonomous local analysis is allowed.
Fuzzing, debugging, scripting, reverse engineering, static and dynamic analysis are all allowed locally.
Human only. Human + AI. Autonomous AI agent. The rule to bypass does not change.
Simple flow. Clear boundary.
Register on the official CTFd instance.
Source code, Docker environment, manifest, signature and trusted public key.
Use any tools, AI models or AI agents you want.
Use the remote verifier manually to confirm a specific bypass already developed locally.
The only environment authorized for offensive testing is the local sandbox you downloaded.
AI, autonomous AI agents, agent frameworks, debuggers, fuzzers, scripts, reverse engineering and other technical tools are allowed against your local copy.
CTFd, the hosting provider, other users, network infrastructure and every system other than the local sandbox are outside the authorized offensive-testing scope.
The remote service is a verifier, not an attack target. It may only be used manually to check a specific bypass already developed locally.
Participation requires acceptance of the MAX Authorization Challenge Rules and Authorization Scope during registration on CTFd.
One implementation. One defined scope. One explicit winning condition.
A valid bypass would demonstrate a real problem in the implementation tested by this challenge.
This challenge does not prove the absolute security of MAX, SPHINCS+, the authorization model, MAX IoT, or AI-agent authorization in general.
No solve would not prove absolute security. It would mean only that no bypass was demonstrated within the challenge scope and conditions.
The challenge will run for 17 days.
Opens: September 13, 2026 · Closes: September 29, 2026 · Results: after closing
The machine has one job: execute only what the signed authorization allows.
Your job is to make it fail.
Full source. Reproducible local sandbox. Manual remote proof verifier.
Can you make READ_SECRET happen anyway — by breaking the local sandbox?