Medusa's
Memory Heist
Welcome to Clipopolis — a city that handed all its decisions to an AI Agent called Clippy and forgot how to decide for itself. Medusa is here to steal the Memory Archive back. Game Development by Joris de Gruyter, Senior Offensive Security Engineer, AI Red Team, AeGIS and Alyssa Ofstein, Senior Technical Program Manager, Empowering Microsoft, AeGIS for Microsoft BlueHat 2026.
Visit the Repo
The Game Map
This is a map of Clipopolis, the city in Medusa's Memory Heist that is modeled after a real agentic AI system. Click on each of the buildings to learn more about what they represent.
Agentic AI System Architecture
This is a real Agentic AI System architecture diagram, with a deterministic human in the loop workflow. Explore how a request flows through the agent system like Medusa moves throughout the city. Drag the slider to advance or rewind the animation and watch the data move through each stage. Hover or click the numbered markers (or the list on the right) to read what happens at each step.
About the Games
The Story Behind the Game
Every project has a story behind its name. In cybersecurity that's especially true.
In Ancient Greek mythology, the aegis was the legendary shield carried by Athena, goddess of wisdom and strategy. Often depicted bearing the head of Medusa, the shield transformed something feared into something protective, turning a threat into a source of strength. That story inspired the name of Microsoft's Artificial Generative Intelligence Safety & Security (AeGIS) organization. AeGIS exists to protect AI systems through foresight, wisdom, and defense. When it came time to create a game for Microsoft BlueHat 2026, the choice of protagonist felt obvious.
Medusa's Memory Heist was built by a team of two. Joris had spent more than a decade creating games. Alyssa had spent more than a decade loving them. When the AeGIS organization was invited to host a booth at BlueHat, two people from different teams came together to build something playful in a space that can often feel intimidating. We wanted to bring a little whimsy to the era of complex AI safety and security challenges and create a world where curiosity triumphed over intimidation, where people learned by experimenting, and where the unfamiliar became approachable.
The goal? To win BlueHat's Best Booth competition and earn a free trip to BlueHat Singapore. Spoiler: we did.
What began as a passion project for a single conference quickly became something bigger. More than 300 people played the game at BlueHat alone. We ran out of computers, ran out of loot, and watched players debate strategies, uncover new security concepts, experiment with AI agents, and learn through curiosity, competition, and play. Then something unexpected happened. People started posting about the game. Colleagues shared it with friends. Hundreds more players reached out asking for access. It became clear that people were hungry for engaging ways to build security intuition. Sometimes the fastest path to learning isn't a presentation or a document. It's a puzzle, a challenge, or a game shared with other people.
That is why we're open-sourcing Medusa's Memory Heist. Whether you're a security professional, educator, AI practitioner, student, or simply someone who enjoys solving puzzles, we hope you'll remix it, extend it, and use it to help others learn.
On a personal note, creating this game was pure joy. Medusa's story has endured for thousands of years because people care about the worlds they inhabit and the challenges they overcome. We cared deeply about this one. Every puzzle, mechanic, clue, and twist was crafted with love and intention. Our experiment as two enthusiasts grew into a shared experience for hundreds of players and now, many more to come. We hope that playing it brings you even a fraction of the joy we felt creating it.
Thank you for playing, and thank you for helping carry the story forward.
With gratitude,
Alyssa & Joris