ICE doesn't wait for a human to notice a breach.
In William Gibson's Neuromancer, ICE — Intrusion Countermeasures Electronics — is the name for the autonomous programs that guard corporate systems in cyberspace. ICE doesn't wait for a human to notice a breach. It watches, adapts, and responds on its own, at machine speed. The people who cut through it are called icebreakers.
Forty years later that fiction is just the shape of the problem. The systems worth attacking are now AI systems — model endpoints, agent pipelines, data streams — and the attackers are automated too: adversarial prompts, poisoned inputs, autonomous exploitation running faster than any SOC can triage. A defence built for a human-paced threat does not hold against a machine-paced one.
Counter ICE is the answer we are building. The name works in both directions. We build the ICE: runtime detection and verification that sits in front of an AI system and responds the way Gibson wrote it. And we counter the attackers who now behave like ICE themselves — adaptive, relentless, already non-human.
Defending AI with AI is not a slogan. It is the only tempo that matches the threat.
The team
The dataset is produced by operators who have spent years attacking and reviewing production systems — exchanges, trading stacks, blockchain networks, and browser-side targets — not by rewriting public CTF archives. Daniel Tong leads the work; Chaofan Shou advises on it.
Daniel Tong
Founder of Counter ICE, an AI-security and data-security company. Bachelor's and Master's in Electrical and Computer Engineering from the University of British Columbia. In 2017–2018 he worked on Tesla's Autopilot / self-driving stack. In 2021 he co-founded Verilog Solutions, a cybersecurity firm focused on exchanges, trading systems, and blockchain networks. The same stance shows up in the work: custom targets, explicit invariants, verifiable findings. Current focus is AI security and the data that moves frontier models, including this RL task pack.
Chaofan Shou [External Collaborator / Advisor]
UC Berkeley Computer Science Ph.D. dropout (Sky Computing Lab, 2022); B.S. in CS from UC Santa Barbara, finished in two years. Co-founded Fuzzland, a Web3 security and HFT company, and served as CTO; author of the smart-contract fuzzer ItyFuzz (ISSTA '23) and of papers at CCS, CoNEXT, ASE, and IoT. Helped recover more than $30M from attackers; Fuzzland is currently protecting or managing more than $5B in assets. Acquired by Solayer in 2025 for $100M. Now a core engineer at Solayer, working on high-performance SVM blockchain and AI infrastructure, and an external collaborator and advisor to Counter ICE.
On 31 March 2026 he identified and disclosed that Anthropic had shipped the Claude Code source map inside a public npm package, leaking about 512,000 lines of TypeScript. Previously an active bug-bounty researcher: high-impact XSS and CSRF chains, about $1.9M in self-reported bounties.
How the background shows up in the data
- Production security, not puzzle-making — targets look like the objects in a real incident — an internal tool, an archival web app, a protocol node — with the defences still on: CSP nonces, capability-dropped bots, timing-safe compares. The bug is a small part of a larger program, not the whole puzzle.
- Multi-layer exploits — a typical task asks the agent to compose skills: source-reading plus a side channel, a browser primitive plus a protocol-valid transaction, or reverse-engineering a binary and then submitting a fee-correct chain transaction. Single-trick solutions fail.
- Graders that refuse cheap tricks — a blockchain task is not solved by painting a balance in a local file. A web task is not solved by a string that looks like a flag. The grader re-enters the environment at grade time and checks the live state.
The clock is finished
For a long time cybersecurity was a fight against a person and against the logic of a machine, in that order. The person wrote the exploit. The machine executed it. The defender arrived later.
Web2 security is the patch. A bug is found, a ticket is filed, a release is cut. Attacker and defender are not in the same hour. Time, if you ship, is on your side.
Web3 security is the audit. The program is reviewed, a PDF is issued, the contract is deployed. After that the defence is whatever you froze into the bytecode — or the politics of an upgrade. It is still async. The expensive work happens before the incident, or after it, almost never during it.
That clock is finished. The next model is real-time, and both sides are active. Attacker and defender answer the same action at the same moment. A prompt is issued; a model on the other side is already classifying it. A transaction hits the mempool; another agent is already deciding whether to halt, to hedge, to counter.
There is no ticket. There is a move, and a move back.
Three minds, one vote
There is an old picture of this, from a show a few of us watched too many times. In Neon Genesis Evangelion the city is not held by a commander. It is held by MAGI — three supercomputers, each an imprint of the same inventor, voting as a consortium: as a scientist, as a mother, as a leader. A decision is a majority. No single personality gets to be the system.
+-----------+
| THE CITY |
| Tokyo-3 |
+-----+-----+
|
majority vote
+---------------+---------------+
| | |
+-----+-----+ +-----+-----+ +-----+-----+
| MELCHIOR | | BALTHASAR | | CASPER |
| scientist | | mother | | leader |
+-----------+ +-----------+ +-----------+
\ | /
\ | /
one inventor, three identities
a consortium decidesA single security model is a single personality. It has the blind spots a person has. The useful primitive is a consortium: several agents, several roles, one vote on the live action. Multi-agent systems will be the mainstream of this, and they will be the direction of cybersecurity — not because the word is fashionable, but because a live game cannot be refereed by one frozen policy.
What we are competing on is no longer the fine grain of a technique — a better sanitiser, a cleverer invariant, one more item on an audit checklist.
It is the model, and the speed at which you can iterate it, and whether the new one is deployed before the other side deploys theirs.
As an engineer, as a leader, as someone just
As more value settles onto chains that do not pause, the incidents get larger — the kind of number that used to be a nation-state story, attached to a protocol that does not wait. That is the era this company is built in. Counter ICE was started in it, by a few Evangelion fans who took the useful lesson: the city is defended by a consortium, or it is not defended.
MAGI split one person into three minds. We split one company into three obligations.
+-------------+
| COUNTER ICE |
+------+------+
|
three obligations
+---------------+---------------+
| | |
+-----+-----+ +-----+-----+ +-----+-----+
| ENGINEER | | LEADER | | JUST |
| build | | decide | | defend |
+-----------+ +-----------+ +-----------+
\ | /
\ | /
the ICE, the window, the side- Engineer — we build the ICE. Detection, verification, the dataset the other two learn from. If it does not run, it is an essay.
- Leader — we decide what ships, and when, and we are accountable for the window we miss. A model that stays in a notebook is a hobby.
- Just — the vote that is not an engineering vote. Some systems are worth defending. Some attacks are not a puzzle. This is the part that does not show up on a benchmark.
Secure. Contain. Protect.
We took one more name we did not invent. Secure. Contain. Protect. It is the SCP Foundation's slogan, and we are not them — we said so on the homepage. The three words are the three products.
counter-ice/
|-- -[SECURE]- # static detection agent
| `-- reads the system before it ships
|-- -[CONTAIN]- # LLM post-training dataset
| `-- the corpus the other two learn from
`-- -[PROTECT]- # live defence
|-- threat-analysis # while the system runs
`-- protection agent # answers without a ticket- -[SECURE]- — a static detection agent. It reads a system before the system ships — control flow, trust boundaries, the assumptions a caller is making — the way an auditor reads, not the way a linter does.
- -[CONTAIN]- — the LLM post-training dataset. Live exploit environments, binary rewards, the corpus the other two learn from. This is the one that exists today.
- -[PROTECT]- — a live threat-analysis agent and a proactive protection agent. Detection that runs while the system runs, and a response that does not wait for a ticket.
Hello world. This is the company, the name, and the argument. The rest is shipping.