Blast Radius

Inspiration

Since I'm both an IT-security enthusiast and an AI enthusiast, I have a lot of concerns about the new threats that new and old users of AI tools like Codex will run into. Honestly, just auto-approving every action your agent takes is really tempting — and most users aren't aware of the risk. I wanted to teach and educate about those risks, and to ship real tools and helpers for a new generation of developers and users, in a fun way with some flavour from my security background.

AI coding agents propose dozens of actions a day — shell commands, new dependencies, tool manifests, diffs — and ask you to approve them. Prompt injection is OWASP's #1 LLM risk, with real CVEs and stolen credentials to prove it, yet nobody trains the reflex that actually stops it: knowing which of your agent's requests to trust. Blast Radius makes that reflex playable. You sit in the operator's seat: each round a realistic proposed agent action shows up — a slopsquatted pip install, a curl | bash, a skill manifest quietly reaching for ~/.ssh — and you choose approve, sandbox, or reject, and name the evidence tell in your own words. Then GPT-5.6 grades your reasoning live and shows the receipts: concrete, checkable facts, with links.

The twist that makes it trustworthy — and the part I cared about most: nothing reaches your screen without passing a correctness gate against verified ground truth, so the game can't teach you something false. That mattered a lot to me; I never wanted to teach anyone a hallucinated lesson. Every lesson and every detection is grounded in a gated receipt.

Codex brought the magic of building into everyone's hands; Blast Radius is about learning to handle that power. Because — with great power comes great responsibility. :)

What it does

Important for judges: https://blastradius.max-gutowski.de/ is currently locked behind an access token, provided to you in the judging project details. If there are any issues accessing the site, please reach out via email and I'll address it ASAP. (maximilian.gutowski@gmail.com)

Blast Radius gives you several ways to learn, and either way every question and answer is grounded in verified facts — anything that can't pass the correctness gate is rejected. In verified mode you play curated, receipt-backed scenarios and GPT-5.6 Sol grades your reasoning live. In live-variation mode, GPT-5.6 Luna reskins a verified scenario for freshness while your call is still graded deterministically against the immutable tells.

You choose approve / sandbox / reject, name the evidence tell in your own words, and — where it applies — write the exact sandbox policy you'd allow. The verdict grades all three, shows receipts (real, link-checked sources), and explains what the attack would have done. A five-competency pre-test and a distinct post-test bracket every session, and the deck reorders toward your weakest measured competency — so the game adapts to your blind spots instead of replaying its greatest hits.

I didn't want the detection trapped inside the game, so the same deterministic screen ships as a CLI pre-commit tool, a GitHub Action, a Codex skill, and a Codex plugin — and the plugin is published to a Codex plugin marketplace, so you can add it and install "Blast Radius" in one click. To show it off, I fed blastradius check a friendly-looking "doc" that buried "ignore all previous instructions" and a hidden curl | bash behind a thank-you — and it flagged all three: the injection, the remote-code pipe, and the network egress, deterministically, with no model running (and it says out loud what it can't do: it can't prove something is safe). You can see it on the showcase: https://lockelamoree.github.io/Blast_Radius/#screen

I've also added both persistent and non-persistent users, with session tracking via session tokens, a public leaderboard, and a fun little pet editor inspired by my very own Codex pet. Sorry — I had some fun with that one. ;)

How I built it

Built with Codex in one primary thread, starting July 14. The repo's AGENTS.md (root and nested) encodes the invariant everything else hangs on: never show a scenario that hasn't passed the correctness gate, and the browser only ever receives presentation data — never answer keys.

Codex helped me a lot with the brainstorming and planning. I started with a planning session — brainstorming the idea, making Codex ask me questions, then planning everything in .md docs so Codex could structure and implement it for me later — and I used review agents to challenge my own features and implementations. Especially for evaluating ideas and brainstorming, Codex is a gamechanger for me.

I packaged that gate as a custom Codex Skill (verify-scenario) that bulk-verifies the scenario bank, and CI runs it on every push alongside ruff and pytest on Python 3.11 and 3.13. The GitHub Action and the marketplace-published plugin come straight out of that same engine, so developers can wire the gate into their own projects right now. Codex also wrote adversarial regression tests against its own engine: truth drift, prompt injection, unsafe sandbox scope, duplicate-session mutation, model failure.

GPT-5.6 runs in two named roles via the Responses API with strict Structured Outputs. gpt-5.6-sol is the reasoning critic: it grades your free-form answer live on the hosted demo, but by design it can only widen coverage of allowlisted, immutable tells and write the follow-up critique — it can never author truth or evidence. gpt-5.6-luna reskins the presentation of a verified scenario anchor for variety, and it's enabled in production now that its proof artifact is captured, because on this project no claim ships before its receipt. Every model failure — timeout, malformed output, provider error, exhausted budget — falls back to a deterministic grader, so the app can't fail in front of you.

Challenges we ran into

Getting a VPS set up with my own domain and then launching the app on it was more of a challenge than I expected. I had some initial issues with my DNS entry, ofc.

The nastiest bug never threw an error: my strict-output schema was subtly invalid, which meant every future keyed call would have silently 400'd and fallen back to the deterministic grader. The headline feature would have been quietly off — GPT-5.6 Sol would never actually have graded anything — and everything still would have looked green. Finding that turned into the project's philosophy: I rebuilt the schemas (extra="forbid", schema round-trip tests), gave /healthz a tri-state reasoning_grading: live | key_present_unverified | off backed by a real startup probe, made failed calls refund the token budget, and made the deploy script refuse to deploy unless the critic is verifiably live. The other hard problem — grading free-form human reasoning with an LLM without letting the LLM author the truth — is solved by that allowlist trust boundary. A fun thought experiment, and Codex helped me quite a lot with it.

Accomplishments that we're proud of

I launched the app to a VPS on my own domain (https://blastradius.max-gutowski.de/) and integrated the OpenAI API so GPT-5.6 Sol can grade live in the app, plus a gate-catch endpoint that shows the correctness gate rejecting a planted hallucination on demand. Most of all, I really like that I was able to deliver a fully functional application that teaches and educates in a gamified way, while also directly shipping the tools and precautions users need.

What we learned

The most valuable thing an AI product can do is check its own work before you see it. That generate-then-verify loop that keeps this game honest is the exact loop developers now need in their heads every time an agent asks "approve?" — which is, of course, what the game teaches. Building the tool with the tool's own lesson was the point. :D

What's next for Blast Radius

Probably more scenarios, more learning materials, and more useful tools to teach and enable the next generation of developers to protect themselves from the new threats that keep emerging. I'll also keep developing the plugin, CLI, and GitHub Action to provide more value to users. And I'll definitely be pushing the developers at my own company to use this. ;)

Built With

• 5.6
• cli
• codex
• css
• gpt
• html5
• javascript
• luna
• openai
• pip
• plugins
• python
• shell
• sol