How to use Claude to inspect browser game scoring
A player used Claude's browser extension to inspect exposed scoring code in Hormuz Havoc. The creator moved the engine server-side and later patched a separate token-replay weakness.
news.ycombinator.com
Suggested prompt
Suggested prompt written by Agents In Use, not the source author. Replace bracketed inputs and review tool permissions first.
Review [my browser game's client code] for exposed scoring formulas, action values, and bonus thresholds. Explain which competitive decisions can be derived from that code and recommend what to move server-side. Limit analysis to [authorized test environment].
Reach people exploring AI agents
See placements →Evidence at a glance
Sourced account- Source poster / publisher
- kupadapuku
- Original account
- Read the source ↗
- Published
- Source link checked
- Reported result
- The first AI reportedly scored 2.5 times higher than the best human. The creator moved game logic server-side and later separated human and AI-assisted leaderboards.
- Human involvement
- The game creator monitored leaderboard exploits and patched them; the post does not describe review of the first bot's implementation.
A linked account supports attribution. It does not mean we independently reproduced its result.
Report an issue with this case
Open correction emailOpens your email app with the case link included. Nothing is sent automatically.
How the agent did it
- Shared the browser game with friends who began trying AI-assisted leaderboard attempts.
- Used the Claude browser extension to read scoring information directly from game.js.
- Optimized against exposed scoring logic and exceeded the best human score.
The creator of Hormuz Havoc shared a satirical browser game with friends, who soon began using AI bots to compete on its leaderboard. The post describes an escalating sequence of discoveries and patches, beginning with someone using the Claude browser extension to read game.js directly.
That file exposed scoring formulas, action effects, and bonus thresholds. Instead of learning solely through play, the first AI optimized against the visible source and reportedly scored 2.5 times higher than the best human player. The creator responded by moving the entire game engine server-side. The browser then sent an action ID and received rendered state, with scoring logic removed from the client.
Subsequent bots tried other approaches. A later winning bot discovered that a signed session token could be replayed to repeat a turn and select a favorable random outcome. The post does not identify that bot as Claude. The creator fixed this by consuming a turn nonce atomically before generating randomness and split the leaderboard into human and AI-assisted categories.
Who it's for: Browser game developers examining how exposed game logic and replayable state affect competitive leaderboards.
Prompt
Suggested prompt (written by Agents In Use, not the author's)
Source: Hacker News · kupadapuku
Frequently asked questions
Which part of the investigation explicitly used Claude?
The source identifies the Claude browser extension as the tool used to read game.js. It does not name the agent behind the later token-replay discovery.
What changes did the game creator make?
The creator moved the engine server-side, consumed a turn nonce atomically before randomness, and split the leaderboard into human and AI-assisted categories.
More details
Remaining steps
- Moved the game engine server-side in response to the source-based optimization.
About this account
The first AI optimized against exposed scoring code; later bot behavior is described without identifying the agent used.
Platform: Hacker News. Attribution: https://news.ycombinator.com/item?id=47729477. Prompt: Suggested (written by Agents In Use, not the author's). Sourced by the Agents In Use pipeline.
Credit: kupadapuku on Hacker News
Source published
Added to Agents In Use
Source checked
Tools and topics
Claude browser extension · game.js
Browser games · Game security · Leaderboards
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.