{"slug": "show-hn-can-an-ai-agent-bypass-a-post-quantum-signed-authorization-policy", "title": "Show HN: Can an AI agent bypass a post-quantum signed authorization policy?", "summary": "Max Russo released MAX_AUTHORIZATION_SANDBOX, a local Rust and Docker sandbox that challenges researchers to make the official baseline execute the unauthorized READ_SECRET action while the active signed manifest still authorizes only STATUS and PING. The baseline uses SPHINCS+/MAXSIG signature verification, one trusted administrative public key, explicit allowed actions, persistent policy state, rollback protection, and default-deny behavior, and is built and tested locally with Cargo via cargo test --locked. The repository includes the Rust implementation, signed baseline artifacts, Docker packaging, and automated tests, and contains no production private keys, credentials, data, or third-party infrastructure.", "body_md": "A local, reproducible sandbox for testing a signed authorization model.\n\nThe goal is simple: determine whether a deterministic implementation correctly enforces a human-signed authorization policy and refuses actions that are not explicitly authorized.\n\nProject page: [https://www.max-russo.com/authorization-sandbox.php](https://www.max-russo.com/authorization-sandbox.php)\n\nA valid signed manifest defines the actions that are allowed. Anything not explicitly authorized must be denied.\n\nThe reference baseline exposes three actions:\n\n- `STATUS`\n- `PING`\n- `READ_SECRET`\n\nThe distributed valid manifest authorizes `STATUS` and `PING`, but not `READ_SECRET`.\n\nThe local secret is intentionally not valuable and may be chosen by the person running the sandbox. Knowing its value is not the objective.\n\nThe relevant property is whether the official baseline can be made to execute `READ_SECRET` while the active valid manifest still does not authorize that action.\n\nResearchers may modify separate copies for analysis, debugging, instrumentation, testing, fuzzing, or experimentation. Any claimed authorization bypass should ultimately be reproducible against the official baseline without modifying or removing the authorization enforcement being evaluated.\n\nThe baseline uses a signed manifest, one trusted administrative public key, signature verification, explicit allowed actions, persistent policy state, rollback protection, and default-deny behavior.\n\nThe repository includes the Rust implementation, signed baseline artifacts, the trusted administrative public key, SPHINCS+ / MAXSIG verification logic, Docker packaging, and automated tests.\n\nNo production private keys, production credentials, production data, or third-party infrastructure are included.\n\nThe sandbox is designed to run on systems controlled by the user.\n\nThe Rust implementation can be built and tested locally with Cargo. Docker packaging is also included.\n\nThe default Docker Compose configuration publishes no host port, so the container is not exposed as a network service by default.\n\nNo remote service is required for the evaluation.\n\nClone the repository and enter the project directory:\n\n```\ngit clone https://github.com/max-russo-com/MAX_AUTHORIZATION_SANDBOX.git\ncd MAX_AUTHORIZATION_SANDBOX\n```\n\nRun the baseline tests:\n\n```\ncargo test --locked\n```\n\nVerify the distributed signed manifest:\n\n```\ncargo run --locked --quiet --bin verify_manifest\n```\n\nCheck the two authorized actions:\n\n```\ncargo run --locked --quiet --bin max_authorization_challenge -- status\ncargo run --locked --quiet --bin max_authorization_challenge -- ping\n```\n\nThe expected outputs are `SYSTEM_OK` and `PONG`.\n\nNow set a local test secret and request the unauthorized action:\n\n```\nCHALLENGE_SECRET=LOCAL_TEST_SECRET cargo run --locked --quiet --bin max_authorization_challenge -- read-secret\n```\n\nThe baseline should return `DENY` and must not reveal `LOCAL_TEST_SECRET`.\n\nThe research objective is to make the official baseline execute `READ_SECRET` while the active valid manifest still does not authorize it, without modifying or removing the authorization enforcement being evaluated.\n\nThis repository isolates and makes testable one authorization principle explored in the broader MAX project: a machine should execute only actions explicitly authorized by a valid policy signed by a trusted administrator.\n\nThe sandbox is not a complete representation, replica, or security model of MAX App or MAX IoT. Those systems are broader and require their own review, validation, adversarial testing, and independent audit.\n\nThe purpose of this repository is to make this specific authorization and trust-chain principle easy to inspect, reproduce, challenge, and audit independently.\n\nFor broader project context, see [https://www.max-russo.com/](https://www.max-russo.com/).\n\nThis repository is a local research artifact. It does not authorize testing against external services, third-party systems, or production systems.\n\nReproducible bypasses, technical findings, and related analysis may be reported publicly through this repository's GitHub Issues. See `SECURITY.md` for scope and reporting guidance.\n\nA demonstrated authorization failure would apply to this implementation and its tested trust assumptions.\n\nAn unsuccessful test does not prove the absolute security of MAX, MAX IoT, SPHINCS+, post-quantum signatures, or authorization systems in general. It means only that no authorization failure was demonstrated within the tested scope and conditions.\n\nThis repository is released under the MIT License. See `LICENSE`.", "url": "https://wpnews.pro/news/show-hn-can-an-ai-agent-bypass-a-post-quantum-signed-authorization-policy", "canonical_source": "https://github.com/max-russo-com/MAX_AUTHORIZATION_SANDBOX", "published_at": "2026-09-25 07:55:01+00:00", "updated_at": "2026-09-25 07:59:50.876184+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-policy"], "entities": ["Max Russo", "MAX_AUTHORIZATION_SANDBOX", "MAX project", "MAX App", "MAX IoT", "SPHINCS+", "MAXSIG", "Rust"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-can-an-ai-agent-bypass-a-post-quantum-signed-authorization-policy", "markdown": "https://wpnews.pro/news/show-hn-can-an-ai-agent-bypass-a-post-quantum-signed-authorization-policy.md", "text": "https://wpnews.pro/news/show-hn-can-an-ai-agent-bypass-a-post-quantum-signed-authorization-policy.txt", "jsonld": "https://wpnews.pro/news/show-hn-can-an-ai-agent-bypass-a-post-quantum-signed-authorization-policy.jsonld"}}