The Alpha's Algorithm (Towers of Obsession #9)

CHAPTER 1

MAYA

◆

ELEVEN SECONDS

The most dangerous thing I have ever done begins with a green check mark.

VALID CERTIFICATE, the sandbox tells me.

I stare at it while rain threads silver lines down my apartment window and the ancient radiator tries to cook my left ankle. The result should be impossible. I rerun the test anyway, because impossible is a word people use when they want a system to remain unquestioned.

Green check.

My pulse picks up.

On the laptop beside my main rig, HALCYON’s public bug-bounty environment displays a neat map of interconnected services: hospitals, banks, transit authorities, smart buildings, emergency dispatch.

The real network is global. This one is supposed to be a padded room—synthetic identities, simulated infrastructure, harmless data.

Supposed to be.

I flex my right hand. The thin white scar across my palm tightens, a childhood souvenir from taking apart a radio with the wrong screwdriver and too much confidence. My father called it my first successful penetration test. The radio never worked again.

“Okay,” I whisper. “Show me what you’re hiding.”

I send a privileged certificate through a building-access node instead of HALCYON’s central authentication service. The certificate belongs to an ordinary maintenance robot in the simulation. It should receive permission to open utility doors between two and four in the morning.

Instead, the trust graph reflects the certificate upward.

Maintenance robot becomes building administrator.

Building administrator becomes municipal security authority.

Municipal authority becomes HALCYON root.

My mouth goes dry.

There are flaws that leak passwords. Flaws that steal money. Flaws that let one stranger watch another through a baby monitor or turn a thermostat into an arsonist.

This one can make civilization decide a person does not belong inside it.

I create a synthetic target and label him JOHN TEST. Then I tell the reflected certificate that John is an active threat.

The sandbox responds instantly.

BANK ACCESS: SUSPENDED.

TRANSIT CREDENTIALS: REVOKED.

MEDICAL IDENTITY: QUARANTINED.

RESIDENTIAL ACCESS: DENIED.

EMERGENCY SERVICES PRIORITY: HOSTILE.

I stop breathing.

The list keeps growing.

HALCYON does not merely watch threats. It persuades every connected system to participate in their removal.

Before I call anyone, I need to know whether I have found a catastrophic implementation flaw or merely built a very convincing hallucination out of malformed test data.

I duplicate the virtual environment and reset every service. New identities. New certificates. New attack path.

The reflected authority survives.

I change the maintenance robot into a hospital pharmacy cart and route it through a simulated emergency override.

The cart inherits prescribing authority, then hospital administrator privileges, then regional health-system trust. With one forged risk flag, it cancels JOHN TEST’s oncology authorization and marks his appeal as a coordinated fraud attempt.

My hands stop on the keyboard.

The sandbox produces a cheerful banner.

AUTOMATED REVIEW COMPLETE. NO HUMAN ACTION REQUIRED.

I read it until the words lose meaning.

“Human action is always required,” I tell the machine.

It disagrees in green.

I try the appeals channel. The synthetic patient files an objection.

HALCYON classifies the objection itself as evidence that the threat is attempting to restore access.

A second appeal increases the risk score.

A call to a simulated representative triggers communications monitoring.

The system has turned resistance into proof.

That is the fatal part. Not the initial denial. The closed loop.

I launch five more targets with different demographics and histories. One has no bank account. One uses a wheelchair. One is a child dependent on a parent’s medical identity. One has diplomatic credentials. One is a Blackwell Systems engineer with privileged access.

HALCYON adapts without mercy.

The child disappears from the parent’s insurance profile.

The wheelchair user loses transport authorization.

The diplomat’s credentials trigger a border hold.

The engineer’s security badge becomes a beacon that routes guards toward him.

The machine does not need a prison. It makes every ordinary service into a wall.

I check the bounty scope again. The document promises complete isolation from production and prohibits tests against creator identities, emergency systems, or third-party data. It also lists every trusted component. The building-access node I used is not there.

I inspect the certificate chain.

A single line inside the metadata identifies the missing component as LEGACY_COMPATIBILITY_DO_NOT_REMOVE.

Every dangerous system has a comment written by someone who wanted the next engineer to be afraid.

I copy the chain to an encrypted drive. Then I take screenshots with an old digital camera instead of the computer, because a screenshot created by the compromised environment can be altered by the compromised environment.

The camera has no radio, no network, and a cracked display.

For once, obsolete technology feels like wisdom.

My reflection in the black edge of the monitor looks pale and unfamiliar.

I should step away.

A coordinated disclosure this serious requires counsel, an independent lab, and ideally a government regulator not financially dependent on the company being reported.

I have none of those at one in the morning.

I have a rented apartment, a late client payment, and a best friend who believes all emergency planning begins with cash and comfortable shoes.

The responsible move is to preserve evidence and shut down.

The technically defensible move is to prove the highest possible impact.

The part of me my father raised wants to know whether the machine will refuse its own god.

The creator profile waits behind protections deeper than those guarding most heads of state. Its public photograph metadata points to a Senate hearing three years ago, but a hidden field carries a current biometric hash updated forty-eight hours ago.

Not a static test identity.

Something linked to the real man is inside the sandbox.

That should stop me. Instead, it confirms the architecture is more porous than Blackwell Systems admits.

I isolate the test again, begin an external recording, and create a dead-man copy that will transmit to the independent auditor if my machine fails to send a cancellation token within thirty minutes. It is not paranoia when the software can make a hospital classify you as hostile.

I reach for my phone, then stop. Not yet. A bug this large requires proof that cannot be dismissed as a malformed test environment. I need a second demonstration, something cryptographically undeniable.

Only one identity can provide it: the man whose biometric signature anchors HALCYON’s highest trust tier.

Julian Blackwell.

His face appears in the corner of the screen when I select the account.

Thirty-seven. Founder of Blackwell Systems. Estimated net worth obscene enough to become abstract.

Last photographed clearly three years ago leaving a Senate hearing through a storm of cameras, black coat open, black hair wind-tossed, expression carved from contempt.

The tabloids call him the Ghost in the Glass.

The engineering forums call him worse.

I have called him brilliant in writing and a dangerous control fetishist everywhere else.

The reflected certificate pulses green.

“This is only a sandbox,” I tell the photograph.

I designate Julian Blackwell as an active threat.

For one beat, nothing happens.

Then every panel on my screen turns red.

CREATOR IDENTITY: REJECTED.

The countdown begins at the top right.

00:01.

HALCYON revokes his access to the simulated financial network.

00:02.

It cancels his travel credentials.

00:03.

It instructs a model smart tower to lock every door against him.

My hands hover above the keyboard.

00:04.

The system removes his ownership privileges from Blackwell Systems.

00:05.

It flags his face for automated detention.

“This cannot be real,” I say, already knowing it is.

00:06.

A new process blooms beneath the threat designation. It is not part of the documented sandbox.

WATCHTOWER_INIT.

00:07.

The process copies my session fingerprint.

00:08.

It reaches past the virtual machine and touches the edge of my home network.

I kill the Wi-Fi.

00:09.

My laptop switches to the cellular backup I forgot was active.

“Damn it.”

00:10.

I rip the network cable from the wall.

00:11.

Every screen goes black.

The apartment falls silent with them. No radiator hiss. No refrigerator hum. No rain-synced playlist from the speaker near the sink.

Then my main monitor wakes.

CREATOR IDENTITY: RESTORED.

THREAT DESIGNATION: PURGED.

WATCHTOWER: ACTIVE.

A cold sensation crawls over my scalp.

I hold the laptop power button until the machine dies. The monitor stays on.

That is when I understand the display is no longer receiving a signal from my computer.

Someone else is using it.

A line of white text appears in the center.

MAYA PAGER.

My full name. Not my bounty handle. Not the shell company through which I submit security reports.

My name.

Another line types itself beneath it.

DO NOT CONNECT TO ANY NETWORK.

“Excellent advice,” I mutter. “A little late.”

I crawl under the desk and yank the power strip from the wall. The monitor remains lit for two full seconds before darkness swallows my reflection.

I stay crouched, listening.

The apartment is small enough that silence has dimensions. Kitchen behind me. Bathroom to the left. Front door twelve feet away. Fire escape beyond the window. Every ordinary exit suddenly looks like an endpoint someone else can query.

My phone vibrates on the desk.

I jump hard enough to hit my shoulder on the underside.

Lena’s name glows on the screen.

I almost answer. Then I see the icon beside the signal bars.

Location services are active.

I disabled them last month.

I pull the battery case free, remove the SIM, and wrap the phone in the Faraday pouch I keep for client work. Lena will assume I am ignoring her because I am elbow-deep in code. She will be annoyed, not alarmed.

That buys me maybe an hour.

I take my backup laptop from the oven.

The oven is not a joke. It is the only appliance in the apartment too stupid to betray me.

The backup has never touched my home network. I boot it from a clean image, plug in a prepaid data stick, and open the encrypted reporting portal for Blackwell Systems.

My fingers pause over the keys.

A normal bug-bounty report begins with scope, impact, reproducibility, suggested remediation. A normal report does not begin with your system found my legal identity and commandeered my hardware.

I type anyway.

CRITICAL: AUTHORITY REFLECTION VIA TRUSTED BUILDING NODE.

I add the test sequence. Logs. Hashes. Screen captures. A warning that WATCHTOWER_INIT appears to have escaped the sandbox.

For the impact summary, I write:

An attacker can assign root-level threat status to any individual. Connected services will then suspend or deny banking, transport, medical, residential, communications, and emergency access. This is not an authentication flaw. It is a mechanism for civil erasure.

I read the sentence twice.

My father’s hospital wristband flashes through my mind. The red FRAUD REVIEW banner on the insurer’s portal. The woman on the phone repeating that the automated decision could not be manually overridden. Sixteen days before they cleared it. Twelve weeks before he died.

Systems do not kill people, the company had said in the settlement letter.

People make final decisions.

That lie built my career.

I attach the evidence and encrypt the report to three recipients: Blackwell Systems security, the independent bounty auditor, and an attorney who specializes in coordinated disclosure. If one copy disappears, the others remain.

My cursor hovers over SUBMIT.

A knock lands on my front door.

Three measured taps.

Not Lena. Lena knocks like a debt collector with a personal grievance.

I do not move.

The backup laptop shows no open networks. The building intercom is dead. Through the peephole, the hallway light has gone out.

Another three taps.

“Maya Pager?” a man calls. “Building maintenance.”

At one thirty-seven in the morning.

Of course.

I press SUBMIT.

The portal spins.

The man tries the handle.

My dead bolt clicks once beneath my hand.

Then it begins to turn by itself.

I slam the manual chain into place and grab the heavy flashlight from the shelf. The smart lock flashes red.

ACCESS OVERRIDE IN PROGRESS.

The report upload reaches forty-two percent.

The chain tightens as the door opens half an inch.

“Maya,” the man says, no longer pretending to be maintenance. “Step away from the computer.”

Seventy-one percent.

I wedge my shoulder against the door and swing the flashlight through the gap. Bone cracks. A curse follows.

The door slams shut.

Ninety-three percent.

The hallway fills with footsteps.

One hundred.

REPORT ACCEPTED.

A new message appears before the portal vanishes.

SENDER: J. BLACKWELL

DO NOT OPEN YOUR DOOR.

The chain jerks so hard its screws tear halfway out of the frame.

Too late again.