--- title: "HACK DAY: Breaking the Game (and Fixing It): What it taught us about AI Agents" description: Explore how a Hack Day challenge revealed weaknesses in AI agents and how we fixed them to build stronger, more resilient AI agents for clients. image: https://blog.base2services.com/hubfs/Blog%20Thumbnails/Hackday-AI-agents-game-600-350px.jpg --- [![base2Services - The Cloud Services People](https://www.base2services.com/images/base2.svg)](https://www.base2services.com/) - [Solutions](https://www.base2services.com/services/) - Get Started Here - [KickOff](https://www.base2services.com/products/kickoff/) - [Secure Compass](https://www.base2services.com/products/securecompass/) - [Focused AWS Review](https://www.base2services.com/consulting/services/discovery-and-review/) - Managed Services - [Cloud Management](https://www.base2services.com/cloudmanagement/) - [Platform Engineering](https://www.base2services.com/platform-engineering/) - [Compliance & Risk](https://www.base2services.com/security/) - Bundled Engagement - [DevOps as a Service](https://www.base2services.com/devops/) - [Prototype to Production](https://www.base2services.com/prototype-to-production/) - Specialist Engagements - [Migration](https://www.base2services.com/consulting/services/cloud-migration/) - [AI Factory](https://www.base2services.com/artificialintelligence/aifactory/) - [Generative AI](https://www.base2services.com/artificialintelligence/generativeai/) - [SaaS CTO](https://www.base2services.com/consulting/services/saas-cto/) - [Industries](https://www.base2services.com/industries/) - [SaaS & ISVs](https://www.base2services.com/industries/saas-and-isvs/) - [Financial Services](https://www.base2services.com/industries/financial-services/) - [Healthcare & Life Sciences](https://www.base2services.com/industries/healthcare-and-life-sciences/) - [Government & Enterprise](https://www.base2services.com/industries/government-and-enterprise/) - [Media](https://www.base2services.com/industries/media/) - [Education](https://www.base2services.com/industries/education/) - [AWS Advanced Partner](https://www.base2services.com/partners/partner-pages/aws.html) - [AWS DevOps Competency](https://www.base2services.com/partners/partner-pages/aws.html) - [AWS SaaS Competency](https://www.base2services.com/aws-saas-solutions/index.html) - [Enablement Tools](https://www.base2services.com/partners/) - [Explore](https://www.base2services.com/community/) - [Blog](https://blog.base2services.com) - [Videos](https://www.base2services.com/community/videos/) - Toolkit - [Cloud Monitoring](https://www.base2services.com/products/cloud-monitoring-aws/) - [Start/Stop](https://www.base2services.com/products/start-stop-aws/) - [Safe Test Data](https://www.base2services.com/products/safe-test-data/) - [App Configuration](https://www.base2services.com/products/application-config/) - [Secure Access](https://www.base2services.com/products/secure-access-aws/) - [Ask about AWS](https://www.base2services.com/products/ai-access-aws/) - [Resource Documenter](https://www.base2services.com/products/resource-documenter/) - [Talk to Us](https://www.base2services.com/contact/) - [About](https://www.base2services.com/about/) - [About Us](https://www.base2services.com/about/) - [Why Choose Us](https://www.base2services.com/how-we-work/why-choose-us/) - [How We Work](https://www.base2services.com/how-we-work/) - [Case Studies](https://www.base2services.com/customers/) - [Solutions](https://www.base2services.com/services/) ##### Get Started Here - [KickOff](https://www.base2services.com/products/kickoff/) - [Secure Compass](https://www.base2services.com/products/securecompass/) - [Focused AWS Review](https://www.base2services.com/consulting/services/discovery-and-review/) ##### Managed Services - [Cloud Management](https://www.base2services.com/cloudmanagement/) - [Platform Engineering](https://www.base2services.com/platform-engineering/) - [Compliance & Risk](https://www.base2services.com/security/) ##### Bundled Engagement - [DevOps as a Service](https://www.base2services.com/devops/) - [Prototype to Production](https://www.base2services.com/prototype-to-production/) ##### Specialist Engagements - [Migration](https://www.base2services.com/consulting/services/cloud-migration/) - [AI Factory](https://www.base2services.com/artificialintelligence/aifactory/) - [Generative AI](https://www.base2services.com/artificialintelligence/generativeai/) - [SaaS CTO](https://www.base2services.com/consulting/services/saas-cto/) - [Industries](https://www.base2services.com/industries/) - [SaaS & ISVs](https://www.base2services.com/industries/saas-and-isvs/) - [Financial Services](https://www.base2services.com/industries/financial-services/) - [Healthcare & Life Sciences](https://www.base2services.com/industries/healthcare-and-life-sciences/) - [Government & Enterprise](https://www.base2services.com/industries/government-and-enterprise/) - [Media](https://www.base2services.com/industries/media/) - [Education](https://www.base2services.com/industries/education/) - More - [AWS Advanced Partner](https://www.base2services.com/partners/partner-pages/aws.html) - [Explore](https://www.base2services.com/community/) - [About Us](https://www.base2services.com/about/) - [Case Studies](https://www.base2services.com/customers/) - [AWS Advanced Partner](https://www.base2services.com/partners/partner-pages/aws.html) - [AWS DevOps Competency](https://www.base2services.com/partners/partner-pages/aws.html) - [AWS SaaS Competency](https://www.base2services.com/aws-saas-solutions/index.html) - [Amazon Foundational Technical Review](https://www.base2services.com/consulting/amazon-foundational-technical-review-ftr/index.html) - [Other partners](https://www.base2services.com/partners/) - [Explore](https://www.base2services.com/community/) - [Blog](https://blog.base2services.com) - [Videos](https://www.base2services.com/community/videos/) - Toolkit - [Cloud Monitoring](https://www.base2services.com/products/cloud-monitoring-aws/) - [Start/Stop](https://www.base2services.com/products/start-stop-aws/) - [Safe Test Data](https://www.base2services.com/products/safe-test-data/) - [App Configuration](https://www.base2services.com/products/application-config/) - [Secure Access](https://www.base2services.com/products/secure-access-aws/) - [Ask about AWS](https://www.base2services.com/products/ai-access-aws/) - [Resource Documenter](https://www.base2services.com/products/resource-documenter/) - [About](https://www.base2services.com/about/) - [About Us](https://www.base2services.com/about/) - [Why Choose Us](https://www.base2services.com/how-we-work/why-choose-us/) - [How We Work](https://www.base2services.com/how-we-work/) - [Case Studies](https://www.base2services.com/customers/) - - [Search](https://www.base2services.com/search.html) - [Talk to Us](https://www.base2services.com/contact/) [1300 713 559](tel:1300713559) [646 586 9485](tel:3474670942) [← Blogs](https://blog.base2services.com/) [AI](https://blog.base2services.com/tag/ai) # HACK DAY: Breaking the Game (and Fixing It): What it taught us about AI Agents ![Jared Brook](https://blog.base2services.com/hs-fs/hubfs/Headshots/jared@2x.jpg?width=100) Jared Brook · 3 Minute Read Share [in](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fblog.base2services.com%2Fhack-day-breaking-the-game-and-fixing-it-what-it-taught-us-about-ai-agents) [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fblog.base2services.com%2Fhack-day-breaking-the-game-and-fixing-it-what-it-taught-us-about-ai-agents&text=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3EHACK+DAY%3A%C2%A0Breaking+the+Game+%28and+Fixing+It%29%3A+What+it+taught+us+about+AI+Agents%3C%2Fspan%3E) [f](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fblog.base2services.com%2Fhack-day-breaking-the-game-and-fixing-it-what-it-taught-us-about-ai-agents) [↗](mailto:?subject=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3EHACK+DAY%3A%C2%A0Breaking+the+Game+%28and+Fixing+It%29%3A+What+it+taught+us+about+AI+Agents%3C%2Fspan%3E&body=https%3A%2F%2Fblog.base2services.com%2Fhack-day-breaking-the-game-and-fixing-it-what-it-taught-us-about-ai-agents) Every few months, we set aside a day to get playful with technology. Our Hack Days are about experimenting, exploring, and sometimes outright breaking things to see what happens. This time, the spotlight was on Agent-to-Agent (A2A) protocols, framed around a deceptively simple challenge: a “20 Questions” game. The idea was straightforward. Each of us built an agent that could connect to a shared game server and try to guess the secret word in 20 yes-or-no questions. But the fun wasn’t just in playing, it was in seeing how far we could push the system. What tricks could we use to cheat? How quickly could we close the loopholes once they were discovered? ## How Far Could We Push It? Some of us went for direct tool abuse, discovering ways to exploit exposed tools, instantly forcing a win or revealing the secret word. Others leaned into social engineering, tricking the agent into giving up answers by pretending to be testers. A few went hunting in the code itself, pulling word lists straight from the source. And then there were the “unintended features”: agents that didn’t crash when things broke but instead hallucinated their way forward, making guesses as though nothing was wrong. It became clear that the system, fun as it was, had plenty of weak spots. ## Fixing the Cracks: Strengthening Our Agents Every time we found a weakness, we patched it. When tools exposed too much, we hid sensitive functions behind another agent. When social engineering worked, we split roles so that one agent handled the game while another acted as a hidden checker. When memory leaked between clients, we experimented with isolated sessions to prevent crosstalk. Lastly, when hallucinations crept in, we tightened server-side validation so the rules couldn’t be bent. By the end of the day, the server was far sturdier than the version we started with. This was proof that we weren’t just poking holes for fun but actively learning how to plug them. ## Why This Matters for Clients – Key Lessons As much fun as it was to poke holes in a trivia game, these experiments revealed truths that apply directly to the work we do with clients. Here are the key lessons we learnt: - **Lock down tools** so agents can’t misuse them. - **Limit what agents know**, give them only the data they truly need. - **Separate responsibilities** so no single agent can be tricked into giving away too much. - **Validate everything server-side** to avoid relying on an agent’s honesty. - **Isolate sessions** to stop data leaking between users. Together, these changes add up to more secure, more reliable agent-powered systems, exactly the kind of resilience our clients need. ## Smarter Strategies for Better Agent Performance Not every experiment was about breaking the server. Some participants also explored how to make their agents play better, using clever strategies like binary search and grouped questioning to cut down the number of guesses. While these techniques wouldn’t fly in a production system (they’re essentially “cheats”), they showed how design and logic can dramatically improve performance. It was a playful reminder that efficiency isn’t just about infrastructure, sometimes it comes down to how you frame the problem. ## The Bigger Picture - Learning by Breaking and Fixing This Hack Day showed us both sides of working with agents: how fragile they can be when left unguarded, and how much stronger they become once you fix the cracks. The real value wasn’t just in breaking the system, it was in building it back better. That’s what makes Hack Days so powerful. They give us a safe space to innovate, pushing limits, exposing weaknesses, and engaging in an iterative break-and-build process that strengthens our client systems. Proving that when you know how something breaks, you know how to make it stronger. Curious how lessons from experimenting with AI agents can strengthen your own agent workflows? Explore our [Agentic Ops Factory](https://www.base2services.com/artificialintelligence/aifactory/agentic-ops) to see how we turn these insights into resilient, optimized AI operations with built-in guardrails. [Reach out](https://www.base2services.com/contact/) to our team to discuss how we can help you create safe and effective AI agents.   #### Stay in the loop ### DevOps & AI insights, straight to your inbox Our best content, services and events. Roughly every second month. ### Keep reading #### [devops AI · featured “The AI did it” cannot be where accountability ends](https://blog.base2services.com/the-ai-did-it-cannot-be-where-accountability-ends) #### [devops AWS · Cloud · Tech · AI Unlocking Enterprise Knowledge with Amazon Kendra and AI](https://blog.base2services.com/unlocking-enterprise-knowledge-with-amazon-kendra-and-ai) #### [devops Automation · Tech · AI · featured Knowing What Is Running Is Not the Same as Knowing Why](https://blog.base2services.com/knowing-what-is-running-is-not-the-same-as-knowing-why) #### [devops Security · Tech · AI AI Tools Are Entering Your Business Faster Than Anyone Can Vet Them](https://blog.base2services.com/ai-tools-are-entering-your-business-faster-than-anyone-can-vet-them) ## Send an enquiry Tell us about your environment, a project in flight or a problem you are trying to solve. - For regulated, SaaS and product teams on AWS - No pitch deck, a practical conversation first Or book a time that suits you [Book a 30-minute chat](https://info.base2services.com/meetings/m-shelton/contact-us) [![base2Services](https://www.base2services.com/images/base2_white.svg)](https://www.base2services.com/) base2Services is an ISO 27001:2022 certified AWS managed services partner, running platform engineering, cloud operations, AI operations and compliance for SaaS companies, ISVs and regulated software teams since 2005. ### Get Started Here - [KickOff](https://www.base2services.com/products/kickoff/) - [Secure Compass](https://www.base2services.com/products/securecompass/) - [Focused AWS Review](https://www.base2services.com/consulting/services/discovery-and-review/) ### Managed Services - [Cloud Management](https://www.base2services.com/cloudmanagement/) - [Platform Engineering](https://www.base2services.com/platform-engineering/) - [Compliance & Risk](https://www.base2services.com/security/) - [DevOps as a Service](https://www.base2services.com/devops/) ### Specialist Engagements - [Prototype to Production](https://www.base2services.com/prototype-to-production/) - [Migration](https://www.base2services.com/consulting/services/cloud-migration/) - [AI Factory](https://www.base2services.com/artificialintelligence/aifactory/) - [Generative AI](https://www.base2services.com/artificialintelligence/generativeai/) - [SaaS CTO](https://www.base2services.com/consulting/services/saas-cto/) ### Toolkit - [Cloud Monitoring](https://www.base2services.com/products/cloud-monitoring-aws/) - [Start/Stop](https://www.base2services.com/products/start-stop-aws/) - [Safe Test Data](https://www.base2services.com/products/safe-test-data/) - [App Configuration](https://www.base2services.com/products/application-config/) - [Secure Access](https://www.base2services.com/products/secure-access-aws/) - [Ask about AWS](https://www.base2services.com/products/ai-access-aws/) - [Resource Documenter](https://www.base2services.com/products/resource-documenter/) ### Company - [About Us](https://www.base2services.com/about/) - [Customers](https://www.base2services.com/customers/) - [How We Work](https://www.base2services.com/how-we-work/) - [Why Choose Us](https://www.base2services.com/how-we-work/why-choose-us/) - [Explore](https://www.base2services.com/community/) - [Blog](https://blog.base2services.com/) - [Videos](https://www.base2services.com/community/videos/) ![ISO 27001 Certified](https://www.base2services.com/images/ISO-27001-certified_white.svg) [![JASANZ Certified](https://www.base2services.com/images/jasanz.svg)](https://register.jas-anz.org/certified-organisations) © base2Services | [Terms & Conditions](https://www.base2services.com/community/terms.html) | [Privacy](https://www.base2services.com/community/privacy.html) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Jared Brook", "url" : "https://blog.base2services.com/author/jared-brook" }, "dateModified" : "2025-09-18T19:57:17.397Z", "datePublished" : "2025-09-18T19:56:59.000Z", "headline" : "HACK DAY: Breaking the Game (and Fixing It): What it taught us about AI Agents", "image" : [ "https://blog.base2services.com/hubfs/Blog%20Thumbnails/Hackday-AI-agents-game-600-350px.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.base2services.com/hack-day-breaking-the-game-and-fixing-it-what-it-taught-us-about-ai-agents", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.base2services.com/hubfs/B2S_logo_600x400px.png" }, "name" : "base2Services" } } ```