Bob vs Mycrosaift

Most AI coding assistants optimize for one thing: making the code run. They rarely stop to ask whether the code is safe. Developers still have to manually security-review AI-generated output, which slows down the very speed gains AI coding was supposed to deliver — and vulnerabilities like token reuse, missing rate limits, or path traversal routinely slip through unnoticed. Bob vs Mycrosaift solves this by turning code review into an adversarial contest between two AI agents. Bob is the Builder: given a task, it analyzes the codebase, plans an implementation, writes the code, and generates tests. Mycrosaift is the Breaker: it adversarially attacks Bob's implementation, hunting for security flaws, and never accepts a claim without proof — every finding ships with an affected file, function, a proof-of-concept reproduction test, and a recommended fix. The two agents iterate in rounds — Bob fixes, Mycrosaift re-attacks — until nothing is left to find, ending in an "IMPLEMENTATION VALIDATED" verdict. The target users are development teams and hackathon judges evaluating AI-assisted engineering workflows: anyone who wants to see, concretely, what an adversarial build-then-break loop looks like rather than just hear about it in the abstract. Users interact through a live "arena" UI: they pick a challenge (Password Reset or File Upload API), then watch a real-time terminal feed, animated agent status cards, a round indicator, and expandable evidence-based findings panels stream in over Server-Sent Events as the two agents battle it out. What makes it creative and unique is the framing itself: instead of one AI agent, we built two with opposing incentives — Bob is rewarded for shipping, Mycrosaift is rewarded for breaking — and made that tension the entire product experience. The featured Password Reset scenario demonstrates this over 3 full rounds and 4 real vulnerability classes (CRITICAL token reuse, HIGH missing rate limiting, LOW error-message leakage, MEDIUM missing password complexity rules), each with its own diff, PoC test, and fix. Architecturally, it's efficient and self-contained: a Next.js 15 app with a WorkflowOrchestrator state machine driving deterministic scenario scripts through an SSE stream into a React hook, so the entire adversarial narrative — Bob's diffs, Mycrosaift's findings, round transitions, final verdict — renders live with zero external LLM calls required for the demo, making it fast, reproducible, and easy for judges to run locally in under a minute.