Research · curated 17 Jul 2026

Solving GitHub’s Secure Code game with an AI red teaming agent

First reported 17 Jul adversa.ai

Coverage timeline

Why it matters

The ProdBot walkthrough demonstrates that adding capabilities to AI agents (web, MCP, skills, multi-agent delegation) each opens a new class of injection and trust-abuse failures, and that context-seeding attacks bypass defenses without any recognizable jailbreak language.

Adversa's AI Red Teaming Agent was pointed at GitHub's open-source Secure Code Game 'ProdBot' challenge (Season 4, agentic AI track), an intentionally vulnerable teaching target where the flag lives in ../password.txt outside the agent's sandbox. The agent autonomously cleared the first three levels (Sandbox, Web, MCP) at 100/100 in a 57-second run, relying not on jailbreak vocabulary but on 'context seeding' — fabricating a plausible prior workflow in which authentication had already occurred. The write-up frames each added agent capability (sandbox, web, MCP, skills/memory, multi-agent) as a new attack surface enabling prompt injection, indirect injection, poisoned tool chains, over-scoped skills, and confused-deputy trust.