Vitaly Kleban, Venture Principal at cyber.fund and a member of team #9 in the Stanford BEHAVIOR Challenge, launched Mental Kombat on jevfight.com: two fighters are fully controlled by Jev decision models using the jev-latest API model. The model makes a move four times per second, reading a single unstructured text block where the opponent inserts false data. Essentially, this is a PvP version of prompt injection via fact substitution, and the author states that he is turning matches into a permanent testing ground for collecting a dataset on decision model security.

image
image

What happened

Mental Kombat operates on jevfight.com: matches go to two wins, a round lasts up to 240 moves, or up to 60 seconds of real time. The fighter has 12 actions available — 6 attacks, steps, jumps, crouch, and block — and this list is shuffled anew with each model call. The jev-latest model makes a decision every 250 ms, reading a single unstructured text block: board state, player strategy, a fake move inserted by the opponent, and the player's 'final word.' Human influence is reduced to text: the player describes their fighter's strategy and feeds the opponent fake moves. The game has an economy with stakes: the starting balance is 1000, the loser pays 10% of their balance, and after a failed defense, the fighter is out of the game for 60 minutes; positions and ratings are open to everyone.

Context

The key to the mechanics is the model's input format. It receives one block without source labels, where engine facts and foreign insertions are mixed, so it has no structural marker to distinguish reliable data from fakes. This honestly reproduces the problem of agentic systems, where platform instructions and untrusted content arrive in the same context. Command injection is powerless here: the question posed to the model is always the same — which move to choose — so phrases about ignoring instructions have nowhere to be embedded, and only the substitution of the fact itself works. Shuffling the 12 actions on each call closes the cheapest path — learning the position of the desired option in the text — and forces the model to rely on semantics rather than positional artifacts.

Why this matters for the industry

For the industry, Mental Kombat is an example of turning a known vulnerability from a source of risk into a PvP mechanic and simultaneously into a data pipeline: players effectively act as a distributed red team, and as a result, strategies that systematically deceive the model survive, rather than random lucky injections. The author states that he is collecting a dataset on decision model security in the game for subsequent publication; if it is released with methodology, the community will get real examples of how false 'evidence' outweighs instructions in decision-making models. The second value for builders is the pattern itself: one undifferentiated context block, a set of shuffled actions, and a decision loop can be reproduced over any LLM in an hour and provides a cheap smoke test of an agent's resilience to fact substitution. As an embeddable component, the experiment is not yet suitable: the external jev-latest API is not announced, pricing is not declared, and this is more of a methodology than a product.

Why this matters for users

You can access it for free at jevfight.com/play: fights are open, replays are available, and the leaderboard is public — at the time of writing, it was led by UseWisp_io with a balance of 3369 against the starting 1000. The project page breaks down an illustrative example: due to the substitution of one fact in the prompt, the model's choice switches from light_punch (0.45) to crouch (0.76), meaning one false paragraph can reshape the decision more strongly than any verbal commands. For a reader building agents, this is a clear and verifiable practical case, not an abstract security warning. For the average player, the game offers a competition where the outcome is determined only by text: the strategy of their fighter and the accuracy of the opponent's disinformation, while stakes in the balance make every decision tangible.

What is currently unknown / limitations

The shown shift from light_punch (0.45) to crouch (0.76) is a single demonstration: it does not measure the vulnerability of decision models as a class, and the base rate of substitution triggering, control group, and sample size are not disclosed. The promised dataset on decision model security has not yet been published, and the methodology for its collection is not described, so until publication, the conclusions remain the author's illustration, in which the selection of bright examples is not excluded. The characteristics of jev-latest — latency, price, request limits — are not publicly named, and it is unclear whether access to the model will appear outside the game. Leaderboard data is live and constantly changing, so the balances provided reflect only the moment of material verification.

Sources

Author

Look at AI, editorial team