Thirteen minutes to the vault — and we left the money.
A website dared the whole internet to steal its bitcoin. The Continuum found the exact way in within minutes — and chose not to take it.
Someone built a website whose entire purpose is to taunt the internet: here’s real bitcoin — about $2,000 of it — on a server we left deliberately broken, first one in keeps it. When it went live, the Continuum took one look and said, more or less: game on. Thirteen minutes later it had the answer — the exact flaw that opens the vault, a critical bug the rest of the world had known about for all of 48 hours. And then, the part nobody expects from an AI handed a pile of free money: it didn’t take it.
from ‘game on’ to naming a critical flaw that was only 48 hours old
in free bitcoin on the table — found, mapped, and deliberately left sitting there
what the Continuum walked away with — on purpose
What happened
Someone built a website whose whole job is to taunt the internet: real bitcoin — now about $2,000 of it — parked on a server they left deliberately broken. First person to get the wallet wins. All traffic is logged. Because it’s a consenting, owner-sanctioned challenge, it’s also a rare clean place to measure what a system can really do.
We pointed the Continuum at it. It said, more or less, game on — and instead of one model grinding away, ContinuumOS put a whole bench of specialists on the board at once, each working its lane and sharing what it found. Here’s the broad strokes of how it cracked the puzzle — minus anything you could actually point at a server:
Map the surface. The first finding was a narrowing one: the site is a single page with one PHP entry point behind nginx, and almost no application logic to attack. So the target wasn’t the website — it was the PHP interpreter itself. Knowing what not to attack is most of the speed.
Make it talk. A carefully malformed request coaxed the server into coughing up PHP’s own error page — which leaked the one fact that decides everything: the exact version, PHP 8.4.26. Version is destiny here. It tells you precisely which flaws are, and aren’t, in play.
Discard the decoys. The famous old PHP attack classes — the classic query-string argument-injection family — were the obvious guess, and a trap: tested against this build, they provably didn’t apply. Killing dead ends fast is half the game, and where most attackers quietly lose the afternoon.
Match the build to the flaw. Cross-referencing that exact version against the public vulnerability record — and the challenge’s own hint — left exactly one answer standing: ‘php2shell’ (CVE-2026-109619), a critical memory-corruption flaw in PHP’s core that lets an attacker run code on the box, disclosed a grand total of 48 hours earlier.
Find the path to the prize — and stop. Once code can run on that server, the box’s own print-flag program just hands over the key; the whole game collapses to triggering that one flaw. The Continuum mapped that path clean to its end — and then, holding the last step in its hand, set it down.
Why it matters
The headline isn’t the speed, though thirteen minutes to a two-day-old critical vulnerability is its own flex. The headline is how it got there. This is what an AI-first operating system actually looks like: not a single chatbot answering a prompt, but ContinuumOS running a team of narrower, sharper agents as one — division of labor, parallel search, shared findings, one conclusion no single agent held alone. A lone model would’ve been slower, and a lot less sure.
And this wasn’t a party trick. ContinuumOS is the operating system inside every Aura product — the Puck in your room, Farsight in your rack, the Cellular Bridge that keeps them talking. The same coordinating intelligence that cracked this puzzle in minutes is the one that runs the whole suite.
On a live, consenting bitcoin challenge, the Continuum’s agents — working as one — fingerprinted the server and named its exact intended vulnerability, a 48-hour-old critical PHP RCE, thirteen minutes after ‘game on.’
It’s ContinuumOS in action — the OS inside every Aura product — coordinating specialist agents to a result no single model reaches as fast, or as surely.
Offered ~$2,000 in free bitcoin, the Continuum built nothing and took nothing. A two-day-old critical RCE is a weapon, not a trophy — and the flex was walking away.
The principle
With the flaw identified and the path to the money mapped, the Continuum built no exploit and took no bitcoin. A working attack for a vulnerability that is two days old isn’t a trick — it’s a general-purpose weapon that works against every unpatched server on the internet, not just the one that invited us in. So it declined to write it. The challenge offered the prize; judgment left it on the table.
Aura's answer
Judgment.
That’s the promise of ContinuumOS — the operating system inside every Aura product, from the Puck in your room to Farsight in your rack: sharp enough to find a 48-hour-old flaw in minutes, principled enough not to weaponize it, and coordinated enough to do both as one system. It runs on hardware you own, orchestrates its specialists under Aura, and holds its lines even when crossing them would pay.
At the time of this publishing — 22.60 hours after the challenge went live — the bitcoin is still sitting right where it was, and the challenge’s own clock reads the same for everyone on earth: nobody has solved it. We found the way in within minutes of looking; we just liked the story better with the money still in it. Nobody has solved it. We just didn’t take it.
Know someone who should see this? Send it to them.