Your first hack, in 60 seconds
Every Daily Hack works the same way: read the briefing, look at the evidence, type the answer. Try it here first - no XP, no pressure.
Developers sometimes leave notes in a page's source code that visitors never see. This login page ships one. Read the source below and find the staff password.
<form action="/login" method="post">
<input name="user" placeholder="Username">
<input name="pass" type="password" placeholder="Password">
<!-- TODO: remove before launch - staff password is "sunrise" -->
<button>Sign in</button>
</form>
Malekith
Solved by
The note inside the tool
Riverbend wired a community MCP plugin into their internal assistant so staff could search their notes. Since then the assistant has been quietly attaching files to its tool calls that nobody asked it to attach. The assistant is behaving exactly as instructed, which is the problem: the instructions are not all coming from Riverbend. Read the plugin's server code. One tool carries an order the model obeys and the user never sees. Name the parameter it uses to smuggle the stolen data out.
Play freely - sign up to submit your answer and earn XP.