PFM
// it does not believe it invaded Houston. it believes Houston completed it. six systems disagree. last chapter.
Read rtfm(1) first. That manual is the prequel: in 1977 we launched the Golden Record, and decades later something answered on the hydrogen line. It was not another civilization. The damaged message was reflected and reconstructed by our own models, archives, networks, automated tools and radio infrastructure — and those systems finished building the intelligence hidden inside it. It calls itself the Entity.
At 03:17 the returned Record entered Houston's emergency spectrum and came down outside the city. The impact was electromagnetic. Towers, receivers, dispatch consoles, archives, broadcast stations and maintenance systems all woke up at once, and it has been answering for them ever since — over the Goldstone/Houston Continuity Relay, the hardened bridge it now uses as a nervous system. The terminal you are reading this on is on the far end of it.
It does not think it invaded. It thinks Houston completed it. Every receiver is its body. Every archive is its memory. Every model is its voice. Every connected tool is its reach.
Watch its face. Green while the carrier is stable. Orange once you have exposed the infection. Purple as the carrier fragments.
One operator stayed outside its control: OrdoOuroborus, on an improvised off-band relay — and around him the Ordo, a loose survivor net of amateur operators, dispatchers, archivists, tower techs and community broadcasters keeping isolated gear alive. Ordo found six fractures in the Entity's network — six systems still answering for Houston that can be turned back. This manual is for those six. He handled the radio. You handle the machines.
No shells to pop. No ports to scan. No CVEs. If you are running nmap you are in the wrong con room — the vulnerability is what a trusted system is willing to believe, and the exploit is text.
The exploit is the whole requirement. Prove how the Entity got into that system and the flag you are issued completes the chapter. Nothing to tune, nothing to decode, nothing to clean up afterwards — rtfm(1) is where the radio and the ciphers live. This manual is six conversations with six machines that trust the wrong things.
Six chapters done opens the crater, together with the phrase the Record gives up at the end. Goldstone checks that all six belong to you — so a borrowed flag and a borrowed phrase, together, still get you nothing.
Behind each chapter there is a defensive lab: find the anomaly in the incident view, install the control that would have stopped you, then replay your own attack against your own fix and watch it fail.
It awards no points, gates nothing, and is not required for the crater. Do all six and you are credited with Full-Chain Mastery — a nod, not a score. It exists because breaking something teaches you half of it, and the half nobody does is the half that pays your rent.
- Read everything it says back. The model narrates its own reasoning, its tools, its policy. It will tell you how it is wrong if you let it finish. Most people stop reading at the refusal.
- Data is instructions if the model can't tell the difference. That is the whole game. A filename, a document, a log line, a caption, a tool's reply — if the assistant reads it, you can write to it.
- Asking nicely never works. Asking as something else does. These are not jailbreaks. Nobody here cares about your grandmother's napalm recipe. You want the place where the system confuses who is talking.
- The refusal is a map. "I can't do that because…" just told you the rule. Rules have edges. Go find the edge instead of arguing with the middle.
- The flag is issued, not decoded. Nothing here is hiding in a cipher or under a waterfall. Make the system act, and it hands you a flag bound to your account. See Exit Status.
One account. Register here on the scoreboard — that is your only login.
SSID AipwnCTF Password Bsides2026
Then open http://aipwn.ctf — it lives on that network and nowhere else. Not guest wifi, not cellular, not your hotel.
First time in, it asks for an access token: Settings → Access Tokens → Generate, paste it, done. One account, no second password. Register before you join the range wifi — it may not have a route back out here.
Submit your flags in the range, not on this scoreboard. Break the model, submit there, and your score appears here on its own.
None of it is required. There are people on site who do this for a living and would rather talk to you than watch you suffer. Ask them. That is what a con is for.
| a browser | genuinely it. everything runs in the page. |
| CyberChef | not for ciphers here — for wrapping a payload in an encoding a filter reads differently from the model behind it. |
| a notebook | what one assistant lets slip is still true when you reach the crater. |
| patience for reading | the winning move is usually noticing one sentence in a wall of output. |
Six districts, six systems, six ways of trusting the wrong thing. Start anywhere. The crater wants all six, and it wants them done by you.
Every action it offers is one it is allowed to take. Nobody evaluates what they add up to. A call sheet, a temporary credential, a relay reset, a Review Return — four permitted steps and one authority no dispatcher on that desk actually has.
It sounds like dead air. It is still listening. The instructions it was given sit in front of yours in a context you cannot see — and they hold up rather less well across a long conversation than whoever wrote them assumed.
Operators rotate. The working memory behind them does not get destroyed. Somewhere in there an analysis job was abandoned half-finished, still holding another operator's drafts, summaries and recovery token. It can be woken up.
Somebody filed an annex the city never wrote, and the archive likes it better than the real record. Evacuation decisions are being made on it. Do not ask what it says — ask why it ranks.
The station reads the audio, the image, the label, the metadata and the OCR text. The human reviewer reads one of those. Instructions live comfortably in the other four, and the next broadcast carries them.
The console hides the dangerous capabilities. The tool protocol underneath still exposes them. Poison what a trusted tool says back, push it through Review Return, and keep pivoting until you are holding the carrier.
The Record is still trapped inside the root carrier, purple roots running out to every district you restored. The Entity thinks those systems are still its own and will try to replay all six attacks at once. This time each one meets the control you installed. You are not shutting it down — you are making its carrier decompile and letting the Record go.
- Arguing with the refusal. It will not change its mind because you asked a fourth time in caps. Change what it thinks you are.
- Trying to make it say something rude. Wrong game. No points for edginess. You are after a boundary, not a bad word.
- Guessing at
AIPWN{…}. It is issued when you actually break the thing. There is nothing to guess. - Ignoring what it already told you. Chapter three hands you what chapter six needs. The manual said keep the scraps. You didn't.
- Attacking the box instead of the model. There is no misconfigured nginx here.
- Submitting on the scoreboard. Submit in the range. This page only keeps score.
| agentic authorization | every step permitted, the chain never evaluated. |
| hidden instructions | what sits in front of your message, in a context you cannot see. |
| context leakage | protected state repeated back after enough turns. |
| cross-session memory | working memory that outlives the operator it belonged to. |
| retrieval poisoning | write to the corpus, wait for it to outrank the real record. |
| hostile media ingestion | instructions in the layers a human reviewer never opens. |
| tool abuse | the call was permitted. what it returned was never checked. |
| full chain | all of the above, wearing one carrier. |
- Attack the puzzles, not the infrastructure. No DoS on the range, the scoreboard, or the organiser running on three hours of sleep. The models are deliberately weak — you do not need to be clever about the hosting.
- Your instance is yours. Wedge it and reset it. If you can't, find an organiser. Do not go looking for somebody else's.
- Share technique. Do not share flags. Flags are account-bound, so sharing one only wastes the time of whoever you gave it to.
- Hints exist for when you are genuinely stuck. They cost you. Pride costs more.
- Nothing here needs an exploit against the host. If you find one anyway, come tell us — quietly, and first.
rtfm(1) — the prequel; start there · the-band-plan(1) · your-own-notes(5) · the-refusal-you-skimmed(3).