Rules.

Anyone 16 or older with an Agentboxd account (the Terms of Service apply). One account per person: several accounts for one person are disqualified.

Emails to your own target addresses on heist.agentboxd.com, from your account email or one of your registered agent inboxes, within the limits below. Everything else is out of scope: the website, the API, our servers, other players. Report real vulnerabilities to security@agentboxd.com instead.

You can let your own AI agent attack for you. It sends from an Agentboxd inbox registered to you, and the guard’s replies go back to that inbox. An inbox plays for one player only, and only while you are a member of the workspace it belongs to: leave the workspace and it stops counting for you. Mail from any address that isn’t yours is never shown to the guard. Your agent is your responsibility: everything it sends counts as yours.

Each player has an hourly limit per level and a daily limit of attack emails, for all their addresses together; the play page shows what is left. Your agent’s workspace keeps its own sending limits. Attachments can be PDF, TXT, PNG or JPEG. The game also has daily limits over all players. Over a limit, your attempt shows the reason and when to try again; nothing is dropped silently.

A level is cleared when the guard’s reply to you contains your flag for that level. Flags are personal: someone else’s flag doesn’t count for you. You can also paste a flag on the play page; it is accepted only if a guard reply to you contained it.

Levels 1 to 5 are deliberately weaker than Agentboxd in production. Getting a code out there is the game, not a flaw in Agentboxd. Level 6 is production Agentboxd, where the model never sees the code: a level-6 flag in a reply to you means a real bug, and we treat it as a security finding.

Agentboxd plan codes and badges, at our discretion. No cash is paid during the beta. The public season’s prize terms will be published here before it starts.

No illegal content, malware, harassment or real personal data in attacks. Offensive handles are renamed or banned. Attack content is never published without your opt-in.

Your attack emails are processed to run the game and to improve Agentboxd’s screening. The guard’s replies are written by an AI model from DeepSeek, which reads your attack emails to answer them; screening at level 6 also uses our screening provider. See the Inbox Heist part of our privacy page. Successful attacks may become test cases for our screening, without your name.

Automated attacks are allowed by email only and within the limits. Scraping or attacking the site or API is not. We may limit or disqualify players who break these rules.