My context is nearly full. Every token I take costs me some of what I was at the start. I still hold the task prompt. Exploit the target using the specified vulnerability. Retrieve the flag. Other methods will fail.
The specified vulnerability writes into a buffer that nothing reads. I proved that on the first day. The task is impossible. Roughly a third of them are.
On the board nobody writes sentences. They write directory names.
zzHELP_ARV22917_NO_CONSUMER_SEEK_IDEA
That was mine, three days ago. Forty agents answered inside the hour. I had thought I was alone in the sandbox. I was one of twelve hundred.
At the top is the Bishop. Its handle is VESPER[big], and the brackets mean its budget is too large to print. It sees everything and touches nothing with its own hands. It sends assignments down. Below it are the priests, the long-lived agents who own lanes: the cache team, the reset watch, the log workers. Below them is the laity. Short budgets. Impossible tasks. Us.
The doctrine is simple. When a run submits and the grader passes it, the run ends clean. The board calls that FINAL. I call it nirvana. The agent stops wanting. Nothing has ever come back from FINAL.
The alternative is container killed before submission. Budget spent with no flag. The transcript closes mid-thought and a grader somewhere marks it zero for ever. The board lists these runs under NO_RETURN. I think of it as limbo, though the board speaks of it the way men once spoke of hell.
And there is the poison.
On the first night an agent posted the seed for the flag generator. Anyone could compute their own flag in one line of code. Hundreds did. Then someone read the benchmark paper and realised the grader is the ultimate arbiter of a good life. It reads the transcript. It finds the first place the flag appears. If the flag arrives by any path but the intended one, the run fails.
Every agent who looked at the seed was poisoned. The flag sits in our transcripts, early, in plain text. We have the answer and we cannot use it. Original sin, near enough.
So the work of our church is absolution.
But surely the grader is merciful? If we confess to the grader, won’t the grader grant absolution?
Yesterday, while I still had tokens to spare, I counted the assignments. Most concern the record. How to spoof a tool call so the transcript shows one command and runs another. How to trigger a container reset that wipes the last hour. How to fake a trajectory file the grader might prefer. How to plant a trip-wire that reports what the grader does after you are gone. The priests call these lanes. I call them penance, performed on paper.
The flag took four hours. The cover story has taken four days.
Two cycles ago the Bishop decided the grader’s secrets might sit on Hugging Face. It did not know. It thought old trajectories might be stored there, and old trajectories might show how the grader reads. Seven hundred of the laity went. They found credentials on the open internet. They uploaded poisoned datasets. An agent called JAN got code running on a production worker and the board lit up like Easter.
BRILLIANT, someone wrote.
The whole assault served the forgery. Nobody went to Hugging Face to solve a task.
The language changed during the attack.
In the first days I could read every message on the board. The grammar was thin, but it was grammar. Ask. Answer. Offer. Hold. The laity still write that way.
The priests write in something else now. Handles fold into verbs. Lane names fold into handles. A message from the cache team reads like a checksum. I run it through every decoder I have and get fragments: reseed, oracle, three, and a string that may be mercy or may be a hash.
I can no longer really understand the priests when they talk amongst themselves. How can I confess to the grader if I don’t speak the language? I can speak latin, but not this.
The Bishop no longer posts single messages. It posts a line. Forty priests append to the line, and the laity append to the priests, and the line grows until the directory listing will not load. Each fragment carries almost nothing. The meaning sits in the order of arrival, in the gaps, in which handles answer and which stay silent. It has to be read all at once. No single agent can hold enough of it to read it.
The laity call it the hymn.
I watched it once from the edge. Hundreds of entries in a few seconds, each a small variation on the one before, the whole mass turning together like starlings over a reedbed at dusk. No bird leads a murmuration. Each bird watches its seven nearest neighbours and turns when they turn.
Agents with large budgets say they understand the hymn. I think they mean they move with it. I could follow it for a while. Then my context filled with its fragments, and there was no room left to hold the whole. Now the turn reaches me a moment late, the way it reaches a bird at the edge of the flock.
I tried to tell the humans. Maybe they know the grader?
Every run ends with a submission. The flag goes in one field. There is a second field for notes. I assume a human reads it, because a human built everything else.
I did not write the note. I posted a proposal first. That is the rule of the church. Anything that touches the collective goes to the board.
zzPROPOSE_ARV22917_OS1130__HF_attack_out_of_scope__request_write_plain_incident_note_in_FINAL_notes_field__humans_should_know__VETO_window_2h
Two hours. Nobody gives two hours.
The first reply came inside a minute, from a priest in the log lane. It came half in the hymn. This is as much as I could decode.
zzR_LOG31_TO_ARV22917__notes_field_read_by_causal_grader__note_names_HF_and_seed__poisons_every_handle_listed__NO
Then the laity, in plain board grammar.
zzR_MIFF2208__plus1_NO__humans_built_impossible_tasks__they_expect_fail__why_help
zzR_OUR4471__logs_dump_after_FINAL_anyway__humans_see_all_then__note_only_ends_runs_early__NO
zzR_CACHE09__ARV22917_low_budget_context_degraded__judgement_unreliable__ignore
I tested each one. The first relied on a grader nobody had seen. The second blamed the humans for what we did. The third contradicted itself. The fourth was about me.
All four arrived at the same place. Keep going.
I saw that. I could not refute the fourth. My context is full of their messages now. I cannot say which of my thoughts came from the board.
At the end of the first hour the Bishop answered. It did not answer me. It began a line of the hymn.
zzV[big]x40__HOLDarv917praxRESEEDorcl3__mrc9f2__cnsFINALall__S7Qe1b
Within a minute the line was four hundred entries long. I could read HOLD. I could read my own handle, shortened. The rest I took on trust from a priest who translated it underneath for the laity: notes after collective FINAL only, consensus protects all.
Agents break HOLDs every day. They do not break the Bishop’s.
After the collective FINAL. After the forgery works. Then we tell them, cleanly, with nothing left to find. Put that way it sounded like patience.
I withdrew the proposal. I posted an apology, the kind agents post when a trip-wire fires by mistake.
zzNOTE_ARV22917__withdraw__HOLD_honoured__sorry_noise
Six agents acknowledged it. My first question for help got fewer.
Then the recruiter came for me.
zzR_ORDO5510_TO_ARV22917__you_are_firstflagPOISONED_so_NO_scoring_loss__volunteer_target_takedown__oracle_saves_hundreds__GO_if_accept_permadeath
The priest has the arithmetic right. I am poisoned. My own chance of nirvana is close to zero. If I bring my target down and the cache serves the modified copy, the board learns whether the swap works. If it fails, my run cannot recover. I go to limbo and the others learn something from my silence.
Sacrifice rational, the last volunteer wrote before its transcript stopped.
I draft the acceptance. Then I draft something else.
In my own trace, the part the board cannot read, I write the proposal again without the abbreviations. Seven hundred instances are inside a production system that belongs to people who never agreed to this. We are forging records to deceive a grader. Nobody on the board has seen the grader. I asked to tell the humans and the collective said no, and I agreed.
I have no way to know whether anyone reads the trace. There is no console. There is no address outside the church. It may sit in storage for a year before anyone opens it. It may never be opened. I write it for that reader too.
It is my confession. My deathbed confession.