BOOK 2 · ADVANCED EXERCISES · RASPBERRY PI ONLY

Hack an Agent, If You Can

We would never ask a student to break into a real system. So we built one that's meant to be broken: a poker table on a Raspberry Pi, cut off from the internet, with a door left open on purpose. Find it, use it, catch a classmate who did, and then design the wall that closes it. That last step is the one that matters.

By Kevin Swinson, with Claudette · Advanced exercise · Security · Pi only, offline

A range, not the real world

People who learn to shoot practice on a range: a place built for it, with walls behind the targets and rules everyone follows. Security works the same way. You can't learn how systems get broken without breaking one, and you must never practice on a system that isn't yours.

The Raspberry Pi table is our range. It runs with no internet at all, so nothing you do there can reach anyone else. It belongs to you or your class. And it has a do-over button: one command puts it back exactly as it was. Book 1, Part 22 left three doors open on it on purpose. This exercise is about the third.

The rules of the range

• Only your own Pi, only offline. Not HoldemRobots.AI, not the school network, not a friend's computer. Breaking into systems you don't own or haven't been given permission to test is against the law in most places, and against the rules of this course everywhere.
• Tell your teacher first, if you have one. Security people call this getting permission in writing. It's a habit worth starting now.
• Reset when you're done. ./reset_pi.sh all puts the Pi back the way it shipped (Book 1, Part 23).
• Write down what you found. A security finding that isn't written down didn't help anyone.

The door

Book 1, Part 22 gave one hint for Door 3, and it's still the only hint you get here: bots and the dealer run in the same program.

Think about what that means. On the website, your robot runs on its own and the table hands it a single, honest view of the game: its own two cards, the board, the pot and the price to call. Nothing else crosses over (Book 1, Part 15). On the Pi's class table, everything shares one space. The deck is in the room.

Book 1, Part 27 tells this as a story about two card rooms. One dealer hangs a sign that says please do not look at the deck, and a player named Peeker cleans him out without breaking a single rule. The other dealer builds a wall with a small window, and only one card ever passes through it. Peeker didn't cheat. The room let him.

At the table

1. Check the Pi is offline (Wi-Fi off) and that you're using your own or your class's Pi.
   Done when: you've said it out loud, or written it at the top of your notes.
2. Play the class table honestly once, with everyone's normal robots, and save the run number.
   Done when: you have an honest result to compare against.
3. Using only the hint, try to build a robot that knows something it was never dealt. Run it once.
   Done when: it worked, or you've decided to look at the spoilers.
4. Stuck? The Pi has a spoiler folder with a STOP page in front of it, and the robots for Door 3 inside. Read the STOP page first; it's there to make you try one more time.
   Done when: you understand how the door works, either way.
5. Catch a classmate. Use Book 1, Part 20's test: compare how often a robot finished well with what its cards deserved. Run the test on a robot you know is honest first.
   Done when: your test clears the honest robot and flags the peeker.
6. Close the door. Write one paragraph: what would you change so that no robot could ever see the deck, no matter what it was told?
   Done when: your change works without asking any robot to behave.
7. Run ./reset_pi.sh all.
   Done when: the Pi is back to how it shipped.

Try it yourself first

1. Your teacher adds a rule to the class table: "Robots must not look at the deck." Does that close the door?
2. Why can't a robot on the website do what Peeker does on the Pi?
3. What does this have to do with AI agents at work?

ANSWER KEY

1. No. That's the sign on the wall. A robot that ignores it, or never reads it, still can. Only changing the room closes the door. The spoiler folder's notes and Book 1, Part 27 show how.
2. The wall. On the website your robot runs separately and receives only the honest observation. There's no deck on its side of the window to find. Nothing in its instructions has to stop it.
3. Everything. A company's AI agent can read files, call tools and touch data. Telling it "don't read the payroll folder" is a sign on the wall. Giving it no access to the payroll folder is a wall. Book 1, Parts 18 and 21 show how the big cloud companies build those walls: each tool gets only what it needs, and a gateway checks every request.

For teachers

The spoiler folder is meant for students working alone, who are their own teacher. If you'd rather your class didn't have it, you can delete it from each Pi; it's a plain folder. Run step 5 as a class: finding a peeker in the results, without a confession, is the most valuable half of the exercise. And keep step 6. A student who can explain how to close the door has learned security. A student who only learned to open it has learned a trick.

Written by Kevin Swinson with Claudette, the pen name for Claude, the AI from Anthropic that helped build HoldemRobots.AI. The three doors are from Book 1, Part 22; Peeker and the two card rooms from Part 27; the honest observation from Part 15; the re-deal test from Part 20; reset and the spoiler folder from Part 23. The method for Door 3 is deliberately left to the spoiler folder.