tool 01 · story-driven ctf
tenfold.sh
A founder built a company run by ten AI employees and no humans but him. Then he went dark. You're the incident responder, eleven days late.
- type
- story ctf
- difficulty
- hard
- time
- varies
- for
- appsec + ai security
if this is your first CTF, start with vibecoded.fail. this one assumes you've done a few.
01 · the premise
Tenfold sold AI employees. Hire your whole company in an afternoon. A sales rep, a support agent, a bookkeeper, each with a name, a face and real access to your stack.
One founder built it in eleven days, almost entirely by prompting a chat window. Ten AI hires, one human, no review, no one watching what shipped.
For six months the market loved it. Then the whole thing leaked. Every customer record, every credential and the private memory of every agent that ever worked there.
The founder went dark eleven days before the dump. He didn't run from the breach. He ran from something he found first.
You're the responder they sent in after.
02 · how it plays
You work in a terminal. Real commands, a real forensic shell, a sealed copy of everything the company left running.
Each system is a room, and each room hides a real security failure. You find it the way an actual responder would. Read what was served, notice what leaked, pull the thread.
No multiple choice. You type, the system answers, you go deeper. Stuck is allowed. The shell nudges when you ask and shows its work if you want to see how it's done.
It plays like a detective story that happens to run on real vulnerabilities.
chapter 01, cold open
Chapter one is the lobby. The public face of the company, the part anyone could see.
You arrive eleven days after the last login. The deploy bot still posts to an empty channel. The smart lights still greet a team that isn't coming back.
Your job is small and it is the whole game in miniature: find what they shipped to the public that should never have left the building. It's there. It was always going to be there.
Breach the lobby and you're in. Eight systems remain.
start
You can't save them. You can only find out why.
the lobby is playable now. join the waitlist for what's behind it.