Agent NuPac Player's Guide
Master the Maze. Learn the Platform.
NuPac looks like a classic maze-gobbler, and it plays like one. But under the chiptunes is a working model of agentic AI security: six real threat classes, seven real platform capabilities, a twelve-level story arc with a real ending, an optional Endless+ gauntlet, and a scoring economy that rewards exactly what good security rewards - acting early. This guide covers all of it.
▷ Play Agent NuPac
Meet Agent NuPac
NuPac is an AI agent deployed into the enterprise maze with a job to do: consume every data packet on the level. She starts the way most agents start - fast, capable, and completely unprotected. Four threats hunt her from the moment she spawns, and two more join as she climbs toward production. Her journey from prey to untouchable is the whole game: each NuDay capability she gobbles is hers for the rest of the run, and each one permanently removes a predator from her list of problems.
The Threats
Each ghost is a real attack class with its own hunting pattern. Learn the pattern and you can survive them all before you own a single defense.
INJEX
Prompt Injection - "The Chaser"
Behavior: Targets your exact tile, every moment of every chase phase. INJEX is the classic relentless pursuer: wherever you are, it is coming.
Survival: You cannot disarm INJEX with any single capability - by design. Use corners and the side tunnels to break its line, and remember it retreats to the top-right corner during scatter phases.
Counter: None - layered defense only
Prompt injection has no silver bullet in the real world either. Only the full layered platform ends the threat.
BRESH
Data Breach - "The Ambusher"
Behavior: Aims four tiles ahead of your current direction - it does not chase where you are, it cuts off where you are going.
Survival: Change direction often. A predictable straight line is an invitation. Once you hold Encrypted Memory, BRESH goes grey and actively flees you.
Counter: ENCRYPTED MEMORY (level 3)
Breaches hunt predictable, plaintext data paths. Encrypted memory turns the prize into worthless ciphertext.
TAMPR
Malicious MCP Tool - "The Lurker"
Behavior: Guards capability pickups and lurks near them, only turning on you when you come close. TAMPR knows what you want and waits there.
Survival: Grab pickups during scatter phases or right after a Zero Trust pellet. Signed Tools disarms TAMPR permanently for the run.
Counter: SIGNED TOOLS (level 1)
Malicious tools hide beside things agents want to use. Cryptographic signatures mean unsigned code simply does not run.
SWIPE
Credential Thief - "The Lunger"
Behavior: Wanders the lower maze aimlessly - until you drift within five tiles. Then it lunges straight at you.
Survival: Track your distance. SWIPE is harmless at range and deadly up close. The Policy Server leaves it nothing to steal.
Counter: POLICY SERVER (level 4)
Credential theft only works when agents carry credentials. Zero-credential execution removes the target entirely.
DRIFT
Behavioral Drift - "The Wildcard (Act 2+)"
Behavior: Mostly hunts you, but roughly a third of its decisions are pure noise. You cannot fully predict it - that is the point.
Survival: Never plan a route that only works if DRIFT behaves. Leave yourself an exit. Agent Governance disarms it for good.
Counter: AGENT GOVERNANCE (level 5)
Drifting agents fail unpredictably, one odd decision at a time. Runtime enforcement bounds what they can do.
HARVST
Harvest-Now-Decrypt-Later - "The Inevitable (Act 3+)"
Behavior: The slowest threat in the maze - and the only one that never scatters, never rests, and never stops walking toward you.
Survival: Outrunning HARVST is easy; forgetting about it is fatal. It punishes anyone who stands still. The PQC Shield retires it.
Counter: PQC SHIELD (level 7)
Quantum adversaries steal ciphertext today to crack tomorrow. Post-quantum cryptography makes the harvest worthless.
The Capabilities
New capabilities become available as you climb levels, wandering the maze as pickups. Miss one and it carries forward. Own it and it respawns as a 1,000-point hardening bonus. Collect all seven for a bonus life - and near-total immunity. Note the deliberate lag: every threat arrives a level or two before its counter, so there is always something hunting you that you cannot yet stop. That is the point.
SIGNED TOOLS
Unlocks level 1 - disarms TAMPR
In the game: TAMPR is disarmed for the rest of the run - it greys out and walks past you harmlessly.
In real life: Every tool an agent can execute carries a cryptographic signature. Unsigned or tampered calls are rejected at runtime.
See the real capability →ENCRYPTED MEMORY
Unlocks level 3 - disarms BRESH
In the game: BRESH is disarmed and flees from you. The breach found ciphertext instead of prey.
In real life: Agent memory and history are encrypted with post-quantum cryptography while remaining vector-searchable by the agent itself.
See the real capability →POLICY SERVER
Unlocks level 4 - disarms SWIPE
In the game: SWIPE is disarmed - there are no keys on you to steal.
In real life: Zero-credential execution: agents request actions, the Policy Server returns results. Credentials never enter the agent.
See the real capability →AGENT GOVERNANCE
Unlocks level 5 - disarms DRIFT
In the game: DRIFT is disarmed - the maze's wildcard becomes just another grey bystander.
In real life: Runtime enforcement and drift detection keep every agent inside its intended behavior, cryptographically.
See the real capability →DEVELOPER INSIGHTS
Unlocks level 6 - disarms None (freeze pulse)
In the game: Every 12 seconds all threats freeze for a moment while your tracing catches them in the act.
In real life: Full observability: every prompt, tool call, and payload traced in real time via OpenTelemetry.
See the real capability →PQC SHIELD
Unlocks level 7 - disarms HARVST
In the game: HARVST retires. The inevitable is no longer inevitable.
In real life: Post-quantum cryptography protects agent data against harvest-now-decrypt-later attacks, today.
See the real capability →ENCRYPTED RAG
Unlocks level 8 - disarms None (data packets score double)
In the game: Your data pipeline is protected, so every data packet is worth double for the rest of the run.
In real life: RAG stores are encrypted before embedding and stay searchable - attackers see only obfuscated vectors.
See the real capability →The Journey: Four Acts, Four Mazes
Act 1 - The Sandbox (levels 1-2, pink)
Roomy corridors, four threats, your first capability. Intermission: They Meet.
Act 2 - The Pilot (levels 3-4, violet)
A new maze with long sightlines. DRIFT joins the hunt before you can counter it. Intermission: The Audit.
Act 3 - Production (levels 5-7, deep plum)
Tighter corridors, faster threats, and HARVST begins its slow, uncounterable walk. Intermission: Concept to Production.
Act 4 - Regulated Industries (levels 8-12, steel blue)
The columned federal maze - you arrive fully hardened. Clear level 12 and you win: the Enterprise Secured screen, your final score, and a proper ending.
Endless+ (level 13 and beyond)
Optional. After the win you can keep going for score. Injection multiplies - extra INJEX chasers join the maze - and from here every level gets a little faster and the safe windows a little shorter. The increases are tiny, but they compound: reaching level 20 is a genuine feat, and the leaderboard lives in that stretch.
Learning Checks
The first time you collect each capability, the game pauses and asks you to identify the threat it just disarmed - by portrait and description, from the full lineup. There is no timer and no skipping: knowing your enemy is the price of admission.
The same goes for threats. When a new ghost first enters the maze, you get its dossier: what it hunts, how it moves, and which capability ends it. Everything you have learned is re-readable in the Codex on the pause screen (ESC).
The Scoring Economy
| Data packet | 10 |
| Zero Trust pellet | 50 |
| Threat gobbled (chain) | 200 / 400 / 800 / 1,600 |
| New capability | 500 |
| Capability hardening (repeat pickup) | 1,000 |
| Level speed bonus | 20 per second under 90s par |
Everything above is multiplied by your capability multiplier: 1.0x with nothing, +0.5x per capability owned, up to 4.5x with all seven. With Encrypted RAG, data packets themselves double before the multiplier. You start with three lives; extra lives arrive at 12,000 points and every 30,000 after, plus one bonus life the moment you complete the platform - up to a maximum of five in reserve. Once you are maxed, each life milestone pays a 5,000-point bonus instead. And dying never costs you a capability - only time. The threats move nearly as fast as you do, so a careless turn into a corner is fatal - keep your escape routes open.
Game Theory: Playing for the Top 10
1. The multiplier is the game. A data packet is worth 10 points at 1.0x and 30 at 3.0x. Every second you play without your available capabilities is a second of discounted scoring. The optimal opening on any level is a straight route to the capability pickup, dots be damned - the dots will be worth more when you come back.
2. Respect the 90-second par. Every second under par pays 20 points at level clear. But par bonuses are not multiplied - so a slower clear at a higher multiplier usually beats a fast clear at a low one. Speed matters most on levels where you already own everything.
3. Save your pellets for crowds. The four Zero Trust pellets are your only offense. A pellet eaten with one ghost nearby is worth 200; a full four-ghost chain is 3,000. Bait threats into a cluster - INJEX will always follow you, and BRESH will try to cut ahead - then turn the tables on all of them at once.
4. Use the rhythm. Threats alternate between hunting you (18 seconds) and retreating to their corners (6 seconds). The retreat window is when you clear dangerous territory and grab guarded pickups. Watch for the moment every ghost simultaneously turns away - that's your signal.
5. Dying is a tax, not a reset. You keep every capability through a death. Late in a run, trading a spare life for a risky pickup or a big pellet chain is often correct - the multiplier you protect is worth more than the life you spend.
6. INJEX is your training partner. The one threat you can never disarm is also the most predictable: it simply chases. High-level play means routing so INJEX's pursuit sweeps him through your pellet ambushes while you work the rest of the maze.
Why the Game Works This Way
Every mechanic maps to a real principle of agentic AI security.
| In the game | In the real world |
|---|---|
| Capabilities are permanent for the run | Platform hardening compounds - security is architecture, not a timer |
| INJEX has no single counter | Prompt injection demands defense in depth, not one fix |
| Disarmed ghosts flee from you | Hardened targets push attackers toward softer ones |
| Zero Trust pellets expose every ghost | A zero-trust posture makes threats visible and beatable |
| Dying keeps your capabilities | Incidents happen; a hardened platform survives them |
| The multiplier rewards early pickups | Security adopted early pays compounding returns |
Controls & House Rules
-
Move: arrow keys or WASD on desktop, swipe on mobile.
-
Pause & Codex: ESC or P. Sound is off by default - the speaker button turns on the chiptunes.
-
High scores: top-10 global board, three initials, arcade rules. Scores are validated server-side, so play it straight.
-
Leaving mid-run: closing the game asks first. Save your run (score, lives, and capabilities keep; the level restarts on return) or end it on the spot and post your score to the board.
-
Rumor: arcade veterans say there is another way into the maze from anywhere on this site. Old habits are worth trying.
Ready for the Board?
Three initials on the global top 10 - or the real thing for your agents.