[BahaaKhateeb123]

The fact that it got overrun in 24 hours is almost more interesting than the game itself. Says a lot about how cheap and easy it is to deploy agents at scale now — the interesting question is what happens when that hits products that actually matter.

[b00gn1sh]

Yeah, this is the part of building browser games that's quietly gotten harder in the last year. I've been working on a Quake III conversion that runs in the browser and I keep bumping into versions of the same problem. Anything the client knows, an agent knows in about five minutes now.

The weird thing is the fix (make the server authoritative) is 90s MMO wisdom, it just used to not be worth the effort for a small game with no money on the line. Now the cost of a bot attempt is basically zero so every game inherits the threat model of a game that does have money on the line, whether you want it or not.

The leaderboard-split thing OP ended up doing is probably the right call for a lot of these. Fighting it is a losing battle when one person with Claude and a weekend can out-iterate you.

[kupadapuku]

The variety of methods each agent tried was also interesting IMO - some going brute-force, others trying to methodically guess the next move. The nice thing about moving the game logic server-side is having some basic logs on how long each game attempt took, and some of the bots were incredibly easy to identify as they selected turns in under a second, while others were harder to spot since they seemed to be reasoning between turns.

[euroderf]

If it had been delivered as WASM, the bots would have decompiled that and optimised against it. Fun times.