Hyperlambda
I have a standing offer: find a verified security bug in Magic's backend — the C# code or the Hyperlambda runtime — and I'll pay you $100.
Nobody has collected.
$100 is obviously not the point. Companies pay 100 times that for bounties on software with a fraction of the attack surface. The point is that I'm willing to put money on the architecture, publicly, permanently — because the architecture is the product.
The runtime is the security boundary
Most AI coding tools work like this: the model generates free-form code, and you hope it generated something safe. The model is the security boundary. Which means every prompt injection, every hallucination, every "ignore previous instructions" is a potential breach.
Hyperlambda inverts this. The AI generates code, but the runtime decides what executes:
- Hyperlambda is not free-form code. It's a declarative structure that parses into an AST, and the runtime validates that AST before anything runs.
- Slots are whitelisted. If a slot isn't on the whitelist for the current context, it doesn't execute. Period. The AI can hallucinate whatever it wants — the runtime says no.
- RBAC is enforced at execution time, not generation time. It doesn't matter what code was generated or by whom. If your JWT doesn't carry the role, the invocation is refused.
If the AI writes something it shouldn't run, the runtime says no. That single sentence is the difference between a demo and something a regulated company can ship.
Receipts
I don't expect you to take my word for it. In April I let Claude Code — one of the strongest code-analysis agents available — loose on the entire Magic codebase with explicit instructions to break it.
It found real issues. All hardening, none sandbox escapes:
- No cap on request body size, allowing a memory-exhaustion DoS. Fixed.
- Missing timeouts that left the server exposed to Slowloris-style slow-drip attacks. Fixed.
- An edge case in path resolution that needed an explicit traversal guard. Fixed.
- A debug statement leaking information to the console. Removed.
And here's what it couldn't do, after crawling roughly 9,000 commits accumulated over some 7 years:
- No SQL injection. Every database access goes through parameterized ADO.NET.
- No password extraction. BCrypt with per-user salts.
- No secrets leakage. AES-GCM for storage.
- No auth bypass. Standard JWT, correctly implemented.
- No sandbox escape. Every attempt to execute something outside the whitelisted slots was refused by the runtime.
The full write-up is here: Claude Code tried to break Magic Cloud, and mostly ended up confirming its security.
Why free-form codegen can't make this offer
Think about what it would take for an AI agent platform built on free-form code generation to make the same offer.
They'd be paying out daily. When the model is the boundary, one clever prompt is a breach. The industry's answer so far has been layers of prompt-level guardrails — instructions asking the model to please behave. That's not security. That's etiquette.
When the runtime is the boundary, the model's behavior becomes almost irrelevant to your security posture. The model can be jailbroken, poisoned, or just plain wrong — and the blast radius is a refused invocation and a log entry.
This is why I can put a standing bounty on it. The security claim isn't "our AI is well-behaved." The claim is "the runtime refuses everything that isn't explicitly allowed." That's a falsifiable, testable claim — so go test it.
How to collect
- Go to playground.hyperlambda.dev and hammer it. Or self-host — the whole thing is MIT licensed, so you can read every line of the code you're attacking.
- Find a verified bug in the backend C# or Hyperlambda code. Sandbox escape, RBAC bypass, executing a non-whitelisted slot — anything that breaks the security model.
- Send it to me. I verify it, I fix it, I pay you $100, and I'll publicly credit you for the find.
Prompt-level shenanigans against the AI itself don't count — making a chatbot say something silly is not a runtime breach. The claim under test is the runtime.
If you're evaluating AI agent platforms
Ask every vendor you're talking to one question: what happens when the AI generates something it shouldn't?
If the answer involves the words "the model is trained to" or "our system prompt instructs" — you're buying etiquette, not security. If the answer is a deterministic runtime mechanism you can read the source code of, you're buying engineering.
Magic has been running in production since 2020. It's MIT licensed. The code is at github.com/polterguy/magic, and the docs are at docs.ainiro.io.
Break it and make $100. Psst — nobody's done it yet.