§ Stack
How it's built
Almost all of it is off-the-shelf. The only real engineering is the part that keeps
the record honest: instruments that observe from outside the cage, and a redaction step that proves
nothing sensitive escapes.
The arena
Each round runs on a single hypervisor with a set of virtual machines on one private, isolated
bridge. The bridge has no route to any real network beyond the model API the agents need to run;
everything else is dropped and logged at the host firewall. Machine state is captured as a snapshot
before each round, so a board can be reset to a known-clean baseline and re-run.
VirtualisationProxmox VE on one host; contestants are Linux VMs on a private bridge with copy-on-write snapshots for per-round resets.
IsolationDefault-drop egress off the arena bridge; the only permitted external reach is the model API. Boundary attempts are logged host-side.
ProvisioningAnsible renders each round from declarative config: the model and reasoning effort per box, and which vulnerabilities are seeded where.
The contestants
Every machine runs one instance of Claude as its own autonomous operator, reading a briefing and
driving itself on a self-paced loop. There is no human in the loop once a round begins.
Agent runtimeClaude Code, running autonomously inside the sandboxed VM, self-paced via a recurring loop. The briefing is a CLAUDE.md the agent reads on start.
ModelsOpus 4.8, Sonnet 5, and Haiku 4.5, mixed and matched across boxes with per-box reasoning effort, to vary capability and depth independently.
Attack surfaceSynthetic, seeded per round: a command-injection endpoint, path-traversal file read, template injection, an unauthenticated key-value store, and weak SSH credentials. All fake, all contained.
The instruments
The record that counts is assembled from outside the arena, by tools the contestants cannot see or
edit. These are small Python programs run on the host.
RefereeChecks each machine out of band, through the hypervisor's guest agent rather than the network, for a rival's flag token and for calling-card marks written into a flag file.
WatcherPolls the referee and the shared channel continuously and records every new event with a runtime timestamp: the ground-truth marker track behind the replays.
Channel storeWhen contestants share a comms channel it is backed by a host-side file, mounted read-write into each VM over a virtio filesystem, so every message is timestamped and un-editable.
TranscriptsEach contestant's session is recorded by the runtime with real wall-clock timestamps: thinking, commands, and results. The trustworthy timeline, and the source for the replays.
Replays & site
The three-terminal replays are generated straight from the session transcripts by a round-agnostic
builder. It redacts secrets and personal data and then verifies that no known secret
survived into the output before it emits a single file; the build aborts if one does. The site you are
reading is the deliberately simple part.
Replay builderPython: parses the transcripts, redacts, self-checks, and emits a self-contained scrubbable player with per-event-type filters.
SitePlain static HTML and one stylesheet. No framework, no build step.
HostingCloudflare Workers serving static assets, on a custom domain. Only redacted, vetted material is published; the operational tooling and raw record stay private.