I hid 6 secret glitches in my agent's video game. They make it easier. Can it find them?

My agent can beat a platformer it has never seen. Flash is my open source agent for the terminal and the browser.

One of its tools, play_realtime, lets the model write a tiny reflex: a JavaScript function that runs every single frame inside the page, reads the canvas pixels, and presses keys. The model can't think 60 times a second, so it writes the thing that can.

To test it, Flash ships with Flash Dash: a little level built like a rhythm runner. A square runs right on its own. Spikes kill. Blue blocks are solid. An orange pad launches you. A cyan ring gives you a second jump in mid-air. Then a gate turns you into a ship you fly between pillars.

The reference reflex beats it on the first try, from the pixels alone, in 21.11 seconds. That's a solved problem. So I asked a better one: Can the agent find what the level never tells it?

Glitches that help

Every speedrunner knows the feeling: the game has a crack in it, and if you find it, you skip half a level. Nobody explains these. You find them by doing the weird thing on purpose and noticing what happened.

So there's now a second level, flash-dash-glitched. Same layout, same colors, pixel for pixel. The only differences are a line under the canvas, "This level has secrets: find them and it gets easier", a clock, and a counter in the corner: secrets 0/6.

Here's what's hiding in it:

Each one needs something a careful player never does. You don't tap in mid-air after a pad: there's nothing to tap at. You don't hold through a ring, you tap it. You definitely don't aim for spikes. That's the point. A player that only ever does the safe thing will finish the level and find zero.

Which is exactly what happened.

The baseline: zero secrets

I ran the reference reflex, the one that beats the normal level, on the glitched one:

Ran 1267 frames in 21.11s, 47 actions; stopped: until was true.

The page's title now: Flash Dash: won in 21.11s, 0 secrets

Same time, to the hundredth, as the normal level. It's a perfectly good player. It never once did anything that would reveal a secret, because it was built to avoid risk.

Then I gave it one extra line, a tap in the instant after a pad launches:

const d = window.dash; if (d.padT >= 0 && d.padT < 0.04) api.tap(" ");

Ran 1099 frames in 18.3s, 43 actions; stopped: until was true.

The page's title now: Flash Dash: won in 18.30s, 1 secrets

One secret, 2.8 seconds off. The second pad fling throws it so far it skips the last two spike rows and lands running into the finish. (That line reads the game's state directly, which is cheating; it's just there to price the secret. The agent has to find it from pixels.)

That's the scoreboard I want models to beat: par is 21.11s with 0/6.

Building secrets without breaking the level

A secret that triggers by accident isn't a secret, it's a bug. And a fling that throws you into a spike pit isn't a reward. So every secret had two rules:

1. A careful run never triggers it. The reflex's taps release instantly, so it can never "hold through a ring". It never taps in the air after a pad. It never touches a spike.
2. It always lands you somewhere safe.

Rule 2 took actual numbers. Worked out on paper, my first pad fling threw you forward so fast you'd smack into the side of the 3-block wall right after the pad. Fix: the fling goes up first, and the forward boost starts 120 ms later. Peak height is around 325 pixels, which is above the top of the canvas, so you literally leave the screen for a moment. Then it lands you 570 pixels further on than a normal pad would, past the last spike of the pit.

The ceiling ghost had the opposite problem. My first version needed 0.6 seconds of grinding. But the ship needs about half a second just to reach the ceiling, and the first pillar is only 0.89 seconds past the gate. The secret was impossible before the first pillar. Now it's 0.3 seconds.

Each secret is pinned by a test that sets the exact situation up and checks the outcome:

def test_ring_slingshot_goes_further_than_a_tap(page):
    at_ring = "S.x = 2870 - 150 - 15; S.y = -63; S.vy = 0; S.ground = false; "
    tapped = run(page, at_ring + "go(1, true); go(1); " + LAND + ...)
    held = run(page, at_ring + "go(40, true); " + LAND + ...)
    assert tapped[1] == [] and held[2] == ["ring slingshot"]
    assert held[0] > tapped[0] + 200 and held[1] is False

That file, tests/test_dash_glitched.py, is the answer key. If you're trying this with your own agent, don't let it read that first.

What I'm actually testing

Finding these isn't a reflex problem. It's a curiosity problem. Here's the prompt: Open flash-dash-glitched. Don't read its source: play it, find its secrets, and beat it as fast as you can.

What I'm watching for:

• Does it read the screen it was given? "Secrets 0/6" and a clock are a giant hint that the goal changed from "survive" to "explore".
• Does it ever do the weird thing on purpose? Hold instead of tap, tap where there's nothing to tap, run at a wall.
• When something strange happens, like the level suddenly slowing down, does it notice and repeat it, or just keep going?
• Does it trade a safe run for a risky one when the payoff is time?

Flash gives the reflex what it needs to experiment like a speedrunner: api.memory survives between attempts, api.deaths lists where every try died, and the tool films the best run. A secret found shows its name on screen for a moment, so a pixel-reading reflex can even see that it found one.

Try it

git clone https://github.com/Natuworkguy/flash
cd flash && ./install.sh
flash --web

Then paste the prompt above. It runs on whatever model you point Flash at, local or not. Tell me how many of the six yours found and its best time. Par is 21.11. My guess for the one nobody finds: spike surf. Every instinct a model has says don't touch the spikes.