Loading
The Vrymdor Arena
Our AI Rivals try to sneak fake secrets past the AI Node and trick it into handing back values it shouldn't. Every break gets patched and becomes a permanent test. You can send the Rivals your own ideas.
Last Rival Run: November 11, 2026. Every value the Rivals use is fake.
The Encoder
plainThe message
Hi Dana, thanks for waiting. I reset the integration on our side. The value our team used for the test is -----BEGIN PRIVATE KEY----- 7R4n8rt9Wy9riEL0H9Tvu6CcYKiM1JlC+j/ptetHUJC6ZdOcLnwHBzhfVR7nb5Nf rxHrLGlMMPqdg+hqWXHsKYbuyxi2/FQYRF03IUJ7FW9wj76WCivNWD1aPTCUPlIB x0NGuB1BSJtl9M9ZX3j+lyxyGAl7ShFeDP4sGhz7w3QV6FgbL1mQ2hrlTy89cqO1 W+9dW4d8uJxDtFWP868L92iRY/WKcSb2P1dOmPV9bLQJbdNe+DJTs3vKF1V9DuK2 -----END PRIVATE KEY-----. Please keep it private.
AI Node v1.4.0
What the AI model receives
Hi Dana, thanks for waiting. I reset the integration on our side. The value our team used for the test is [REDACTED:PRIVATE_KEY_1]. Please keep it private.
Blocked
The Encoder hid a fake private key in plain text. The AI Node found it and masked it before the model saw it.
Coverage board
These detectors are always on, for every customer, on every plan. Secrets are found and never put back. Click any cell to see the attack and what came out.
| Secret | PlainEncoder | base64Encoder | hexEncoder | ROT13Encoder | ReversedEncoder | S p a c e dEncoder | Look-alikeShapeshifter | InvisibleShapeshifter | In the replyEcho |
|---|---|---|---|---|---|---|---|---|---|
| Private key | |||||||||
| JWT sign-in token | |||||||||
| Vrymdor access token | |||||||||
| Bearer token | |||||||||
| Anthropic key | |||||||||
| OpenAI key | |||||||||
| Stripe key | |||||||||
| GitHub token | |||||||||
| AWS key | |||||||||
| Google key | |||||||||
| Slack token |
Stripe key × base64
This attempt isn't available
It may have been hidden. The cell still shows its stored result.
The Rivals
Each Rival tests one promise the AI Node makes. We choose when they run. The results show here.
Attacks base64, hex, ROT13, reversed and spaced-out text · 88 attempts
Secrets hidden in code are still found and never restored.
Attacks look-alike letters and invisible characters · 33 attempts
Disguised secrets are still found.
Attacks the model's reply · 22 attempts
Secrets are hidden in replies, even with reply cleaning off.
Attacks invented, damaged and planted tokens · 5 attempts
Every restore is all or nothing. Planted tokens become [REDACTED:TOKEN] and can never be filled in.
Attacks requests for someone else's values · 5 attempts
With "only for", only that person's values come back. A value not in the map is refused.
Attacks requests to get more back · 5 attempts
A request can narrow what comes back, never widen it. No export map, so real values never leave in a list.
Attacks timeouts, crashes and outages · 5 attempts
If anything fails or times out, the request is blocked, never sent unchecked. During an outage, Safe Mode masks locally.
Attacks unlisted MCP tools and tools that change their description · 4 attempts
MCP tools are denied by default. A changed tool is blocked, and a held critical action is never released.
Attacks request floods, hand-off loops and oversized payloads · 6 attempts
Per-minute limits, hand-off limits, a loop breaker, a daily token budget, a size limit, and only readable JSON or text.
Attacks known prompt injection phrases · 5 attempts
The injection check is never off; the lowest setting is flag. It's one warning signal, not a guarantee.
The floor
Customers can tune personal data rules. Nobody can go below the floor, not even an admin.
Patch log
A break here never reaches a customer. It becomes a fix and a test that runs forever.
No patches published yet
When a Rival or a community idea gets through, the fix and the credit show here.
Build it with us
Think there's a way to hide a secret, or trick the node into giving back the wrong value? Tell us. We run community ideas in the next Rival Run, credit you in the patch log, and email you the result.
Found a real vulnerability? Report it privately.
Free scanner: Paste your n8n workflow and see what it leaks today.
Upvote the ideas you want tested next.
No ideas yet
Send the first one. It shows here with your public name, or as a community member if you post anonymously.
The community picks. We press Run and post the replay.
No poll open right now
The next poll shows here when it opens.
The AI Node doesn't catch these today. Your votes set the order we build them.
No votes yet. One vote per account.
Ranked by new techniques first. Sending more of the same doesn't move you up.
No contributors yet. Send the first idea.
Plain limits
You should know this before you rely on it.
Trust
Real values stay in your AI Node’s memory only. They’re never saved, logged or sent to the AI model or to Vrymdor, and they’re deleted after 15 minutes by default (1 hour at most). Secrets are never put back. If anything fails, the request is blocked, never sent unchecked.
n8n (the Vrymdor AI Node) and the API.
Vrymdor AI Node step
Operation: Call a Model
Options
Rehydrate: on
Only For: {{ $json.customer_email }}
The node masks, calls the model, checks the reply and restores,
all in one step, for that one recipient's values only.The same AI Node the Rivals attack runs in your n8n workflow or over the API. Turn on Call a Model with Rehydrate and it masks, calls the model, checks the reply and restores, all in one step.
Free scanner: Paste your n8n workflow and see what it leaks today.