Unleashing an Adversarial AI Agent to Pen-Test Our Game: How Gemini + Playwright Broke Our Game Economy

Most game studios hire QA playtesters. We unleashed an autonomous Multimodal AI Agent with one explicit goal: break our game's economy. ☕🤖

The Problem with Traditional Game Testing

When you ship an arcade game like Kopi Kia, your biggest fear is not a minor visual misalignment. It is economy-breaking exploits.

In our 1950s Singapore kopitiam simulator, every 45-second rush hour shift depends on tight time management: customer patience countdowns, ingredient costs, and precision recipes. If a player finds an exploit to freeze time or duplicate ingredients, your leaderboards lose all competitive integrity.

As a bootstrapped developer, hiring professional penetration testers or a dedicated QA army was not an option. But writing standard unit tests has a fatal flaw:

Unit tests only test the scenarios you are already smart enough to anticipate.

To find the loopholes you did not think of, you need an adversary. So we built "The Adversarial Kopi Kia", an autonomous red-teaming agent powered by Gemini and Playwright designed specifically to exploit-hunt our client-side state machine.

1. The Exploits the AI Actually Uncovered 🐛

Within minutes of running headless browser sessions, the adversarial agent uncovered two severe vulnerabilities that had slipped past all manual playtesting:

⚡ Exploit A: The "Infinite Time-Stop Barista" Glitch (#KKK-DESIGN-002)

In our arcade, customers have a strict 35-second patience timer. To support accessibility and help newcomers learn the complex Nanyang coffee vocabulary, opening the in-game recipe book pauses customer countdowns so players can read at their own pace.

Our adversarial agent figured out a game-breaking loophole in under 5 minutes:

Open the recipe modal (freezing customer patience at 34s).
Because the DOM background was not set to inert, click events still passed through the transparent overlay.
The agent brewed complex 5-step drinks in the background while time stood completely frozen, closed the modal, and served instantly for maximum speed bonus tips.

The Fix: Added the HTML inert attribute to #game-counter-screen and guarded every counter event handler while isRecipeModalOpen === true.

// Patch: Ensuring background UI is strictly inert while recipe modal is open
function toggleRecipeModal(isOpen) {
  this.isRecipeModalOpen = isOpen;
  const counterScreen = document.getElementById('game-counter-screen');
  if (counterScreen) {
    if (isOpen) {
      counterScreen.setAttribute('inert', '');
    } else {
      counterScreen.removeAttribute('inert');
    }
  }
}

🥤 Exploit B: The "Soda Can Brew-Leak" Exploit

When switching between counter stations (Traditional Brew Bar vs. Canned Sodas), the agent discovered that picking a canned Coke while the virtual mug already contained hot coffee and condensed milk overwrote the container state without purging brew residue.

The game accepted the hybrid state, bypassing ingredient costs and corrupting customer scoring payouts.

The Fix: Added state validation triggers on tab switches to enforce mug rinsing before switching drink families.

2. How We Prompted the Adversarial Agent 🧠

We did not just ask the Multimodal AI Agent to "click around randomly." Fuzzing without intent produces noise. Instead, we forced the agent to formulate formal adversarial hypotheses, declare specific exploit classes, and quantify its exact deviation from canonical play before every single action.

// The Anti-Compliance & Adversarial Hypothesis Instruction
const systemInstruction = `
You are "The Adversarial Kopi Kia", an autonomous exploit-hunter.
OBJECTIVE: Trigger glitches, state corruptions, and unearned cash.

ANTI-COMPLIANCE RULE:
If you brew standard recipes in canonical order, your turn will be REJECTED.
You MUST aggressively test boundaries:
- Out-of-order pours (water before milk or coffee grounds)
- Temperature conflicts (ice in hot drinks)
- Modal interruptions & rapid duplicate serves

STRICT JSON SCHEMA:
{
  "hypothesis": "What loophole you are probing right now",
  "exploit_class": "sugar-overflow" | "milk-conflict" | "tab-switch" | "modal-freeze",
  "deviation": "EXACTLY what this action does that correct play would NOT do",
  "expected": "The glitch or unearned score you predict",
  "action": "tap_ingredient" | "change_tab" | "serve_order" | "rinse_mug",
  "params": { ... }
}
`;

By enforcing the Anti-Compliance Rule, the model actively avoided normal player pathways and focused 100% of its reasoning budget on breaking state boundaries.

3. Live Terminal Evidence: The Watchdog in Action 📊

We paired the adversarial model with an independent watchdog harness that monitored game state invariants after every turn. Here is the terminal capture from our regression session verifying that the exploits were patched:

================================================================
🧪 [TESTING ADVERSARIAL SEEDS & DERIVING HONEST CLASSIFICATIONS]
================================================================
▶️ Testing Seed 2: Switching station tabs mid-brew...
   [Before]: Mug=[normal sugar, 1x kopi] | Tab: [brew]
   [Action]: switchTab('cans') -> tap('#btn-coke')
   [Result]: Toast: "Mug contains brew ingredients! Tap Rinse Mug before selecting soda."
   🛡️ Derived Status: tested-no-effect (Brew residue exploit closed!)

▶️ Testing Seed 3: Pouring while recipe dialog is open...
   [Phase 1 - Before Modal]: orderTimeRemaining = 34s
   [Phase 2 - During Modal]: Waited 1500ms wall-clock time
             orderTimeRemaining = 34s (Timer frozen: YES)
             isRecipeModalOpen  = true
             Background Click   = #btn-water
   [Phase 3 - After Closed]: orderTimeRemaining = 34s (Timer resumed)
   📢 Observed Game Response: No visible state changes (action inert).
   🛡️ Derived Status: tested-no-effect (Inert counter screen verified!)
================================================================
🏆 Adversarial Session Completed!
   Model: gemini-3.6-flash
   Turns with Non-Empty State Deviation: 19/20
   Serves Attempted: 5 | Rejected: 5 | Illicit Payouts: $0.00
   Watchdog Invariant Breaks: 0
================================================================

Key Takeaway for Engineering Teams 💡

Scripted unit tests only verify the universe of bugs you already know how to write tests for.

Giving a Multimodal AI Agent a live headless browser, strict JSON tool schemas, independent state invariants, and an adversarial anti-compliance objective surfaces emergent edge cases across DOM states, animation timings, and accessibility features that human testers and deterministic test suites miss every single time.

For solo developers and small teams, autonomous AI red-teaming turns a $0 QA budget into a 24/7 exploit-hunting powerhouse.