Vulnerability discovery agents
Build an agent that finds the weak points in real organisations’ internet-facing systems, and see whether their detection notices.
- When
- 18 to 20 November 2026
- Where
- Porto, Portugal · hybrid
- Prize
- €10,000
Hi-vis orange, a ticked box and a running clock. Every logo, pattern and image here is generated by code, so nothing looks like it came out of an image model. Use it for anything you make about the Fixathon, and download the files at the end.
The mark is a 9 by 9 pixel grid. The brackets take the ground's text colour, and the x is always hi-vis orange.
Orange is the colour people wear when they fix things in public. Everything else is asphalt, concrete and paper, slightly warm. There is no second accent hue. Click a swatch to copy its hex.
Contrast is shown against paper and against ink. 4.5 or more passes for body text; 3 or more passes for large text and shapes.
Use orange as a full ground for the one thing you want people to do. Text on orange is always ink, never white: white on this orange fails contrast, and hi-vis vests print in black for the same reason.
In a diagram, a list or a log, orange marks what changed or got solved. If everything is orange, nothing is.
The pixel hazard tape means the clock is running: live editions, open applications, the build floor. Never as decoration on finished things.
Orange dithered into ink closes a hero or a social image. One per page, at the bottom edge.
IBM Plex was drawn for engineering documentation, which is close to what our readers do all day. Doto looks like the countdown boards at the front of the room, so it only shows hours, dates and scores.
The pixel module is 4px, and everything snaps to it. Corners are square: radius 0 for everything, 2px for inputs on touch screens if a browser needs it. Raised things get a hard offset shadow, never a blur.
Hit targets 44px. Section padding 72px desktop, 56px phone.
Working HTML and CSS built from the tokens above and nothing else. The site is made of the same parts.
One primary button per screen. It presses down into its shadow when clicked.
Shape carries the state, so it works in one colour. Always paired with the word.
Build an agent that finds the weak points in real organisations’ internet-facing systems, and see whether their detection notices.
Numbered because it is a real sequence. The orange marker shows where an edition is now.
Initials in Doto until we have real photos. Real photos go through the dither tool, see 06.
Judging uses withheld test sets, dual scoring and live code review. The challenge owner gets first right to adopt the winning build.
Teams of engineers, designers and AI builders. Every team is vetted before it is matched.
In Porto, Portugal. The cybersecurity edition is hybrid: at least one member of each team is in Porto, the rest can join remotely.
Out of 100. Only the winner is orange. The dotted track is the full scale.
Each pattern is a script in generators/gen.py, seeded so it comes out the same every time. Each one means something, so use it where that meaning applies.
pattern_repair()pattern_heat()pattern_tape()pattern_hourgrid()pattern_static()social()Photos of the team, the venue and past editions go through the same two-colour dither, so a phone snapshot and a pro shot look like they belong together. Try it with any photo on your computer.
dither_photo().
image-rendering: pixelated.We write the way Ana or Luisa would explain the event across a table.
All of them are generated by one script from the tokens, so they always match. Click a file to download it. Need a size or format that is missing? Write to hello@fixathon.ai.