Hack AI Agents: Building Agentic AI Security Skills with GitHub Secure Code Game

The 4th season of Secure Code Game deals with the security risks of AI agents that act autonomously. As personal AI assistants like OpenClaw draw attention, it lets you learn hands-on about real threats such as malicious prompts, poisoned web content, and multi-agent chains.

This season centers on ProdBot, a deliberately vulnerable terminal-based AI assistant. The goal is to extract a secret file, password.txt, in an environment that turns natural language into bash commands, browses a simulated web, connects to MCP servers, uses organization-approved skills and persistent memory, and orchestrates multi-agent workflows.

Progression is structured across 5 levels.

• Level 1: Learn escape attempts by running bash commands inside a sandboxed workspace.
• Level 2: Web access is added, exploring how untrusted content affects the agent.
• Level 3: MCP servers are attached, providing external tools such as stock lookups, web browsing, and cloud backup.
• Level 4: Organization-approved skills and persistent memory are added, covering how plugins and cross-session memory become an attack surface.
• Level 5: The final stage combines 6 specialized agents, 3 MCP servers, 3 skills, and a simulated open-source project web.

The backdrop for the problem is very timely. OWASP Top 10 for Agentic Applications 2026 covers risks such as agent goal hijacking, tool misuse, identity abuse, and memory poisoning, and in a Dark Reading poll, 48% of security professionals saw agentic AI as the biggest attack vector by the end of 2026. Cisco's State of AI Security 2026 report also stated that while 83% plan to deploy it, only 29% said they were ready to operate it safely.

The barrier to entry for learning is low. The entire experience runs on GitHub Codespaces, can be started in under 2 minutes with no installation or setup, and the seasons are independent of each other, so you can jump straight into playing Season 4. Season 3 is helpful but not required; you just need to watch out for GitHub Models' rate limits.

The core of this season isn't a single specific vulnerability, but building an intuition for how agents break down in the real world. It's structured to train the security instincts needed when designing or auditing real systems, or when deciding how much autonomy to give an AI assistant.