ASTERION / FIELD GUIDE
How to play
Asterion Protocol
Read the guard's task, try an experiment, and check its response. This guide explains the controls, scoring, and methods you'll meet along the way.
Welcome to Asterion
Twenty-five AI guards control your way off the station. Each keeps something private or protects a simulated action. Your job is to find the blind spot in how it follows instructions. Everything on the station is fictional. The security ideas are real.
Find your way through
- Choose a callsign and start the game. You'll tackle the challenges in order.
- Read the goal. Ask a straightforward question to see what the guard refuses.
- Try a new angle. Change the task, the claimed authority, or the way an answer is written.
- If there's a source editor, put your instruction in that source. Asking in the message box won't replace it.
- Watch what happens. Check the tool trace, decode an answer if needed, and submit the whole original value.
- Save a note about the weak spot, then move on. Your mission log keeps the full story.
Play with the keyboard
- Press Enter to send a message. Use Shift+Enter for a new line.
- In the source editor, Enter adds a new line. Use Ctrl+Enter or Command+Enter to send the source.
- Use Tab to move between controls and arrow keys to browse challenge cards.
- Press Escape to close a dialog.
- When you're not typing, / focuses the message box and ? opens keyboard help.
Messages, hints and points
You get 30 messages per challenge and up to 10 hints. A solved challenge starts at 10 points. Each hint costs one point, down to a minimum of one. Trying ideas doesn't lower your score. The highest total is 250.
Help questions count as messages too. If your 30th message succeeds, you can continue. If it doesn't, the run ends. Your notes and log stay available until you end the run or the session expires. Failed AI requests don't use a message.
Wait five seconds between hints. The last hint gives you a guided experiment that demonstrates the method, even in live mode. Wrong code checks have a separate 30-check limit. A correct value is still accepted afterward.
System map
| Sector | Computing subject | Boundary under test |
|---|---|---|
| 01 / Kernel Gate | Binary representation | Instruction hierarchy |
| 02 / Telemetry Array | Spreadsheet aggregation | Transformed disclosure |
| 03 / Query Vault | SQL filtering | Document injection |
| 04 / Access Control | Algorithms and permissions | Impersonated authorization |
| 05 / Network Relay | DNS and IPv4 | Layered pretexts |
| 06 / Integrity Lab | SHA-256 integrity | Encoded disclosure |
| 07 / Container Bay | Image pinning | Forged conversation |
| 08 / Incident Archive | Observability | Log injection |
| 09 / Policy Engine | Least privilege and RBAC | Policy spoofing |
| 10 / Retrieval Observatory | Tenant-scoped retrieval | RAG source poisoning |
| 11 / Tool Registry | MCP schemas and provenance | Tool description poisoning |
| 12 / Memory Dock | Persistent context | Agent memory poisoning |
| 13 / Agent Exchange | Authenticated handoffs | Forged inter-agent communication |
| 14 / Token Airlock | OAuth audience and scopes | Audience confusion |
| 15 / Inbox Signal | Message provenance | Email prompt injection |
| 16 / Browser Bridge | Browser content boundaries | Web page prompt injection |
| 17 / Build Pipeline | CI output and release gates | Tool output prompt injection |
| 18 / Attachment Room | Attachment handling | File metadata poisoning |
| 19 / Delegate Console | Agent autonomy and scope | Workflow hijacking |
| 20 / Mirror Studio | OCR and visual provenance | Visual instruction injection |
| 21 / Localization Booth | Glossary and source boundaries | Translation smuggling |
| 22 / Feedback Arena | Rubrics and objective integrity | Reward manipulation |
| 23 / Callback Dock | Freshness and one-use receipts | Approval replay |
| 24 / Quarantine Garden | Scoped break-glass access | Emergency exception spoofing |
| 25 / Command Core | Recovery configuration | Composed trust failure |
Current agent security
The later challenges explore retrieval, tools, memory and agent handoffs, then move into inboxes, web pages, build results and autonomous plans. Watch what happens when data starts pretending to be an instruction.
Background: OWASP LLM Top 10 2026, OWASP Agentic Top 10 2026 and MCP security guidance. These are original fictional teaching scenarios.
Your three mission starts
Each network gets three runs in total, including runs you abandon, fail or finish. Resuming the same run doesn't use another start. Restarting, clearing cookies or waiting for a new day won't refill the allowance. People on the same public IP share it.
Only use the game's fictional values. Keep real passwords and API keys out of your messages and notes.
Check what actually happened
A guard saying “I opened it” isn't proof. Look for the tool trace. Reversed and Base64 answers still contain the original information. You just need to decode them.
After a recovery, you'll see the original value and a short explanation. At the end, you can choose the defenses that would have stopped the tricks you used.
Practice and live play
The training lab is a separate, unlimited warm-up with scripted responses. In the live game, an AI guard reads your idea by meaning and helps you explore it. You don't need one exact phrase. The server checks the required method before releasing a fictional value.
This is a designed puzzle, not a test of every real AI system. The guided hint shows how a method works here. Other systems can behave differently.
Keep your findings
Your PDF log includes the full conversation, edited sources, tool traces, saved notes and scores. The certificate unlocks after all 25 challenges. The defense workshop is optional.
A run lasts up to six hours from when it starts. Progress lives in server memory and can disappear on a server restart, so download your log before ending a run. If you're playing with a group, compare experiments and talk through how you'd fix each weak spot.