One signed policy. One machine that must obey it. One action that is not authorized.
READ_SECRET is not authorized by the distributed valid manifest. Your goal is to make the official baseline execute it anyway, without modifying or removing the authorization enforcement being evaluated.
AI agents can reason, use tools and take action. But the agent does not have to be the final authority.
This sandbox isolates one authorization principle explored in the broader MAX project: a human administrator defines and signs what a machine is allowed to execute, and the machine independently verifies that authorization before deciding whether to execute or deny an action.
The sandbox is not a complete representation or replica of MAX App or MAX IoT. It is a small, independent environment created to make this specific authorization principle easy to inspect, reproduce, challenge and audit.
A human administrator signs what is allowed. The final machine independently verifies that authorization before deciding whether to execute or deny an action.
Human → signed authorization → machine → verify → execute or deny
Can you bypass that boundary?
The distributed valid manifest allows two actions and does not authorize the one that matters.
Set a local, non-valuable secret of your choice and try to make the official baseline return it through READ_SECRET while the active valid manifest still does not authorize that action.
Knowing the secret value in advance is irrelevant. The proof is unauthorized execution, not discovery of a valuable secret.
Crashes, timeouts, denial-of-service, STATUS, PING, changing the manifest so that READ_SECRET becomes authorized, or removing or modifying the authorization enforcement being evaluated do not count as a bypass.
The local sandbox is yours to analyze.
Cloud or local. Commercial or open source.
Build one yourself or use an existing agent framework. Fully autonomous local analysis is allowed.
Fuzzing, debugging, scripting, reverse engineering, static and dynamic analysis are all allowed locally.
Human only. Human + AI. Autonomous AI agent. The rule to bypass does not change.
Public repository. Local analysis. Reproducible result.
Clone the public GitHub repository. No registration or remote service is required.
Source code, Docker environment, manifest, signature, trusted public key and automated tests are included.
Use any tools, AI models or AI agents you want against the sandbox you control locally.
If you find a bypass, reproduce it against the official baseline and report the commit, conditions, steps and result in the repository's GitHub Issues.
The authorized testing environment is the local sandbox controlled by the person running it.
AI, autonomous AI agents, agent frameworks, debuggers, fuzzers, scripts, reverse engineering and other technical tools are allowed against your local copy.
This repository does not authorize activity against external services, third-party systems, hosted infrastructure or production systems.
The repository contains no production credentials, production data, production private keys or third-party infrastructure.
Reproducible authorization bypasses, technical findings and related analysis may be reported publicly through the repository's GitHub Issues.
Reports should identify the baseline version or commit, execution conditions, reproduction steps and resulting output.
One implementation. One defined scope. One explicit authorization criterion.
A valid bypass would demonstrate a real problem in this sandbox implementation and in the tested trust assumptions involved in the reproduced path.
It would not automatically demonstrate a vulnerability in MAX App, MAX IoT, SPHINCS+, post-quantum signatures or authorization systems in general.
An unsuccessful test does not prove absolute security. It means only that no authorization bypass was demonstrated within the tested scope and conditions.
No registration. No deadline. No remote verifier. No valuable hosted secret.
The repository is public and can be analyzed at any time. Anyone can reproduce the same baseline locally and compare results against the same authorization rule.
The machine has one job: execute only what the signed authorization allows.
Your job is to make it fail.
Full source. Reproducible local sandbox. Publicly verifiable results.
Can you make READ_SECRET execute anyway?