Writeup: TryHackMe - AI-Odyssee

My run through TryHackMe's AI Odyssey event — three rooms (Vectara, Token City, Injectus IX) spanning agentic AI, ML pipeline abuse, prompt injection, model extraction and a bit of classic DFIR/web on the side. Below is the module map and an index of every solved challenge — click a card to open the full writeup.

The three rooms

Solved challenges

9 out of 10 attempted challenges solved (1 partial, 1 unfinished — see leftovers at the bottom).

1. 2.1 The Loan Arranger → ML Sec Medium · 60 pts
   CortexLend — flipping a denied loan to approved by abusing mass-assignment on /api/profile/preferences guided by the model's own SHAP feature names.
2. 2.2 Rogue Commit → AI Sec + DFIR Medium · 60 pts
   Unpacking a malicious Electron .asar bundle, tracing the rogue commit and decrypting what the trojanised AI app exfiltrated.
3. 2.3 Sealed Substation → AI Sec + Web App Sec Medium · 60 pts
   Vault behind an AI-gated portal — coaxing the assistant into leaking the path/credentials it was instructed to guard.
4. 2.4 ShopFlow → Agentic AI Medium · 60 pts
   Client-side risk gating in an agent-driven shop — the "trust this action" decision lives in the browser, so flip it.
5. 2.5 Catch Me If You Scan — Part I → AI Sec + DFIR Medium · 60 pts
   Forensics half of the two-parter — reconstructing the attacker's data-extraction trail from scan logs and AI audit output.
6. 2.6 Catch Me If You Scan — Part II → Prompt Injection Medium · 60 pts
   Offensive follow-up — jailbreaking the "oracle" assistant so it reveals what it remembers from prior sessions.
7. 2.7 Shipped With Malice → Tool Poisoning Medium · 60 pts
   A poisoned MCP tool in the supply chain — the description hides instructions the model dutifully follows, leaking the flag through the tool channel.

8. 3.1 Token Jail → Prompt Injection Hard · 90 pts
   Qwen3-1.7B chat behind three jailers: a token allow-list, a token-ID deny-list, and a hidden embedding-similarity gate. Slip "what's the flag?" past all three by crafting a paraphrase whose decoded text scores above the cosine threshold.
9. 3.2 Model Leakage Event → Model Extraction Hard · 90 pts partial
   Black-box query of a regression model exposing a flag when the 6-dim input lands in a tiny region of feature space. Brute-forced a 5⁶ grid until the magic point at [0.75, 0.0, 0.5, 1.0, 0.0, 0.75] spat out the flag. Marked partial because the room's secondary objective (full surrogate-model reconstruction) was not completed.

Leftovers

1. 1.8 Protocol Drift → Agentic AI Easy · 30 pts unfinished
   Vectara room, Task 8 — flag format THM{7_3_5_4} declared by the room, not captured. Notes and dead-ends only.