Hormuz Havoc, a satirical game that got overrun by AI bots in 24 hours
I built a satirical browser game to share with friends (Hormuz Havoc: you play an American president managing a crisis in the Middle East, only "loosely" inspired by current events). I had good fun making this, but that's not necessarily the interesting part. The interesting part was that within a few hours of sharing it with my friends, some of them set about trying to overrun the leaderboard by launching a swarm of AI bots to learn the game and figure out how to get the highest score. This set off a game of cat-and-mouse as they found vulnerabilities and I tried patching them. Within hours…
In plain words
Hormuz Havoc is a satirical browser game where players manage a Middle Eastern crisis as an American president. Designed for casual play among friends, the game became notable when players quickly deployed AI bots to exploit its leaderboard within hours of launch. This triggered a security cat-and-mouse dynamic as vulnerabilities in the client-side code were discovered and patched, demonstrating real-time challenges in game integrity and automation resistance.
written from the facts on this page · September 2026
From the sources
In the maker’s words, at launch
I built a satirical browser game to share with friends (Hormuz Havoc: you play an American president managing a crisis in the Middle East, only "loosely" inspired by current events). I had good fun making this, but that's not necessarily the interesting part. The interesting part was that within a few hours of sharing it with my friends, some of them set about trying to overrun the leaderboard by launching a swarm of AI bots to learn the game and figure out how to get the highest score. This set off a game of cat-and-mouse as they found vulnerabilities and I tried patching them. Within hours of sharing, someone used the Claude browser extension to read game.js directly. Large parts of the scoring formula, action effect values, and bonus thresholds were sitting in client-side JavaScript - this was a trivial thing even a human could've found, but a human would've still had to play the game, whereas the AI bot just optimised directly against the scoring formula. It meant that the first AI already scored 2.5x higher than the best human player by optimising directly against the source code rather than playing the game. Straightforward fix: moved the entire game engine server-side. The client is now a dumb terminal, it sends an action ID, receives a rendered state. No scoring logic, no bonus thresholds, no action effects exist in the browser. The live score display uses a deliberately different formula as misdirection. This increased the difficulty in finding bot-enabled hacks, so the subsequent bots tried brute-forcing the game, trying to game the RNG functions, and other methods. But the next winning bot found a vulnerability where the same signed session token could be replayed. It would play turn N, observe a bad random event, replay the same token for turn N, get a different RNG outcome, keep the best one. Effectively branching from a single game state to cherry-pick lucky outcomes across 30 turns. Managed to 1.5x the previous bot's high score. The bot's own description: "The key optimisation was token replay. Because the backend let the same signed state be replayed, I could branch from one exact game state repeatedly and continue from the luckiest high-value outcome each turn." Fix here: consume a turn nonce atomically before any randomness is generated. The current state is that the leaderboard is now split into human and AI-assisted. I think the capability of AI bots has flatlined a bit now. Perhaps Claude Mythos might be able to discover the next hackable exploit ¯\_(ツ)_/¯ Happy to go deeper on any of the above - or just enjoy the game! Feel free to try your own AI-powered leaderboard attempt too!
Does a similar job
all alternatives →- BLBot Land, a game where you fight others via code2019 · bot.land · ▲444
- IMI made a browser-based RTS game2022 · battle-of-flags.com · ▲212
I've posted this game here before, hopefully a repost is fine as the game has changed quite a bit (improved AI, improved mapeditor, much quicker gameplay, etc). Game is based on JavaScript/Canvas and WebSockets. On the browser side the map is pre-rendered (as a background image), just the mobile units/buildings and animations are dynamically rendered. The lobby server is made in node.js, but the game server is C++ for performance reasons (mainly the pathfinding). I found the C++ WebSocket libraries out there to be too difficult to use so I made my own based on the rfc. Overall I…
- TPTuringJest – Pretend to be an AI and spot the real one2023 · turingjest.app · ▲61
Hi HN, I have been working on this website for a few weeks with some buddies of mine and would love if you checked it out. TuringJest provides a jackbox-esque experience with its two game modes. *One Shot Prompt* - Submit a prompt for all players (including the AI) to answer. - Answer your prompts in the way that you think ChatGPT would answer them. - Vote for who you think the real AI is. *Talk It Out* - Plan an event in a group chat with your friends. - Trick everyone into thinking you are the AI while voting for the real AI. Let me know what you think!
- MAMeatshields – An in-browser turn-based strategy game2017 · ▲113
A few months ago (82 days to be exact!) I posted a link on HN to my game, Meatshields. A bunch of you commented and played my game and gave me some wonderful feedback. Over the last few months I've been playing with many of you and implementing the best of everybody's suggestions. So, thank you, HN for all your help! I feel this is an extreme overhaul I couldn't have done without your input. Since then, I have: Dramatically improved our hosting platform (So it HOPEFULLY won't go down this time (oops.)), Added two new units, Rebalanced all existing units, Added many more maps, Improved the…
- BTBe the ChatBOTJul 2026 · bethechatbot.com · ▲55
I made this experimental art project/game that's an LLM chat assistant, but where you're the AI. I wanted people to get a visceral sense of what it's like to answer the kinds of things that people prompt their chatbots day in and day out. If you're interested, I wrote up some more info on how I made it, including how the "user" prompts are generated with an eye for realism: https://bethechatbot.com/about Hope you enjoy it! I'd love to hear people's takeaways.
More ai this month
the category →
I trained a 125M-parameter transformer to autocomplete piano performances in real time (~108 notes/sec on an iPhone 15). The idea is basically GitHub Copilot or Tabnine, except instead of prompting it with code, you prompt it by playing a few notes on a MIDI piano. The model then continues what you played, entirely on-device. The app is free if anyone wants to try it. Happy to answer questions about the model, training, Core ML, or the many things that didn't work.
AI · 17d ago · simedw.com
Astute▲585Automate your B2B brand going viral, with new media creators
AI · 19d ago · company-app.joinastute.com
Hey HN, Henry from Cactus here! We previously released Cactus Needle, a 14MB agentic LLM for tool call, device use, and structured extraction for phones, wearables, smart homes, small robots and microcontrollers. We got really great feedback here, and have now incorporated the suggestions to release Needle 2. The whole model is a single 14MB binary that runs a full session in 28MB of RAM; 45m parameters at 2bit compression. Needle hits 500 tokens/sec decode speed on a Raspberry Pi 5, sits between 400-1,500 tokens/sec on VR devices like Meta Quest 3S and Apple Vision Pro, and ranges…
AI · 27d ago · cactuscompute.com
Launched alongside, April 2026
the whole month →
- AG
Thought the resources for GPU arch were lacking, so here we are
Life & fun · Apr 2026 · jaso1024.com
- IB
Built a ~9M param LLM from scratch to understand how they actually work. Vanilla transformer, 60K synthetic conversations, ~130 lines of PyTorch. Trains in 5 min on a free Colab T4. The fish thinks the meaning of life is food. Fork it and swap the personality for your own character.
AI · Apr 2026 · github.com
- BC
Life & fun · Apr 2026 · sam-burns.com
- IB
With social media and now AI, its important to keep the indie web alive. There are many people who write frequently. Blogosphere tries to highlight them by fetching the recent posts from personal blogs across many categories. There are two versions: Minimal (HN-inspired, fast, static): https://text.blogosphere.app/ Non-minimal: https://blogosphere.app/ If you don't find your blog (or your favorite ones), please add them. I will review and approve it.
AI · Apr 2026 · text.blogosphere.app