Counterproof: Zero-Blast-Radius Bug Hunter

Created by team Counterproof on November 08, 2026

C1-Blast Radius Zero

"Wrong Answer" with hidden tests is one of the most frustrating moments in competitive programming, coding interviews and programming classes. LLMs can read code, but their verdicts are opinions. Counterproof makes bugs reproducible. How it works: paste a problem statement and your solution (Python or C++). An agent on Vultr Serverless Inference (qwen3.8-27b) writes a brute-force oracle and a seeded random input generator. The oracle must first pass the statement's sample cases; crashing tooling is fed back to the LLM for repair. The agent stress-tests your code, smaller inputs first, and stops at the first mismatch. That input is replayed in a fresh second sandbox, and only a reproduced mismatch is reported, with expected vs. actual output, an LLM explanation and fix, and a downloadable Proof Pack (SHA-256 of every program, generator seed, both runs). Blast Radius Zero: all untrusted code, user-submitted and LLM-generated, runs in a fresh Docker container on the gVisor (runsc) runtime with no network, a read-only root filesystem, RAM-only scratch space, memory caps, a 64-process limit, CPU and wall-clock limits, all capabilities dropped and no secrets inside. The Detonate tab runs a fork bomb, HTTP exfiltration, rm -rf / with writes to /etc, a memory bomb and an infinite loop, then shows a Blast Log of the restriction triggered and host checks. Vultr stack: Serverless Inference for planning, repair, explanation and the demo's TTS voice-over; Cloud Compute (Tokyo) hosts the FastAPI backend, Docker and gVisor. The API key never enters git or a sandbox. Business value: coding-education and assessment platforms could turn a red X into a reproducible failing case, priced per submission or by licence; the sandbox layer is reusable for any product running LLM-generated code. Limits: no counterexample does not prove correctness (the UI says so); the oracle is LLM-written, validated on samples, and every mismatch is replayed.

Category tags:

Developer Tools

Github Presentation Demo

Explore more applications

Wayfinder, Lumen OCR and Provenance RAG on ROCm

My three AMD AI League entries are all built on the mandated ROCm PyTorch base image and run Qwen3-VL-8B-Instruct in bf16 on the AMD GPU. A resident server loads the model once and listens on a unix socket, so each harness call to /app/app.py is a thin client that finishes inside the 30-second budget. The weights ship inside the images, and nothing is downloaded at evaluation time. Match 4, Wayfinder (web information retrieval). It reads a natural-language request, fetches the start page and ranks same-site links by how well they match the question. Each page is cleaned to text, with tables kept as rows. The model then either gives the value with the passage it came from, or picks the next link to open, for up to three hops. An answer only counts if it appears on a cited page, and if nothing is found the output is an empty answer. It also works on a saved copy of a site (--corpus). Match 2, Lumen OCR, reads licence plates and road signs. On Chinese plates it keeps the province character; on US plates it drops the state banner and slogan. Multi-line signs are joined in reading order, and when the first pass is unsure about a hard image (glare, blur, noise) it reads an enhanced copy again. Match 3, Provenance RAG, indexes PDFs, Word files, spreadsheets, CSVs, logs, source code and images (read by the vision model) once. Empty folders, unreadable files, encrypted PDFs and unknown types are skipped. Each answer cites only the files it needed, a multi-hop chain cites every file in the chain, and withdrawn revisions are ignored. Each project is also a reusable tool with a CLI, a Python API and a local Studio web UI. On the public samples, using AMD Token Lab's hosted Qwen3.8-27B, Lumen OCR scored 10/10 and Provenance RAG 10/10. I have not yet run the shipped 8B model on an AMD GPU. Match 4 image: docker.io/abuhuraira0001/alx-workbench:m4-v1 Code: github.com/abuhuraira99/wayfinder, github.com/abuhuraira99/lumen-ocr, github.com/abuhuraira99/provenance-rag

Abu Huraira

AMD ROCmQwen3-VLHuggingFace Hub

Quarantine: proof before the install

An agent triages an untrusted package before install: it plans probes, runs them in a hardened container on Vultr, and returns a verdict backed by the egress proxy log, the process result and a filesystem diff the package cannot write.

Kosi IT

DryRun AI

DryRun AI analyzes Python code, executes it inside a restricted Docker sandbox on Vultr, and compares AI-generated predictions with recorded execution evidence in a structured report.

DryRun AI

VULTRAntigravityAnthropic ClaudeChatGPTCodexQwen3

AgentBoundary AI: Secure AI Agent Execution

AgentBoundary AI is a task-aware security gateway that helps control autonomous AI execution through revocable permissions, isolated-execution design, and auditable security decisions.

The Explorers

thatakumu52341

Upcoming AI Hackathons
For Innovators & Creators

Explore more applications

Wayfinder, Lumen OCR and Provenance RAG on ROCm

My three AMD AI League entries are all built on the mandated ROCm PyTorch base image and run Qwen3-VL-8B-Instruct in bf16 on the AMD GPU. A resident server loads the model once and listens on a unix socket, so each harness call to /app/app.py is a thin client that finishes inside the 30-second budget. The weights ship inside the images, and nothing is downloaded at evaluation time. Match 4, Wayfinder (web information retrieval). It reads a natural-language request, fetches the start page and ranks same-site links by how well they match the question. Each page is cleaned to text, with tables kept as rows. The model then either gives the value with the passage it came from, or picks the next link to open, for up to three hops. An answer only counts if it appears on a cited page, and if nothing is found the output is an empty answer. It also works on a saved copy of a site (--corpus). Match 2, Lumen OCR, reads licence plates and road signs. On Chinese plates it keeps the province character; on US plates it drops the state banner and slogan. Multi-line signs are joined in reading order, and when the first pass is unsure about a hard image (glare, blur, noise) it reads an enhanced copy again. Match 3, Provenance RAG, indexes PDFs, Word files, spreadsheets, CSVs, logs, source code and images (read by the vision model) once. Empty folders, unreadable files, encrypted PDFs and unknown types are skipped. Each answer cites only the files it needed, a multi-hop chain cites every file in the chain, and withdrawn revisions are ignored. Each project is also a reusable tool with a CLI, a Python API and a local Studio web UI. On the public samples, using AMD Token Lab's hosted Qwen3.8-27B, Lumen OCR scored 10/10 and Provenance RAG 10/10. I have not yet run the shipped 8B model on an AMD GPU. Match 4 image: docker.io/abuhuraira0001/alx-workbench:m4-v1 Code: github.com/abuhuraira99/wayfinder, github.com/abuhuraira99/lumen-ocr, github.com/abuhuraira99/provenance-rag

Abu Huraira

AMD ROCmQwen3-VLHuggingFace Hub

Quarantine: proof before the install

An agent triages an untrusted package before install: it plans probes, runs them in a hardened container on Vultr, and returns a verdict backed by the egress proxy log, the process result and a filesystem diff the package cannot write.

Kosi IT

DryRun AI

DryRun AI analyzes Python code, executes it inside a restricted Docker sandbox on Vultr, and compares AI-generated predictions with recorded execution evidence in a structured report.

DryRun AI

VULTRAntigravityAnthropic ClaudeChatGPTCodexQwen3

AgentBoundary AI: Secure AI Agent Execution

AgentBoundary AI is a task-aware security gateway that helps control autonomous AI execution through revocable permissions, isolated-execution design, and auditable security decisions.

The Explorers