我通过"破解"Paxel系统漏洞成功进入YC创业学院

简要：我发现 Y Combinator 通过 Paxel 在全球范围内为创业者评分超过 10 万美元，我破解了它（可能是复活节彩蛋）+ 发现了一个漏洞，使任何人都可以伪造并推送任意分数到他们的排名数据库，这都归咎于未验证的 hmac

最新更新：YC 值得赞赏，没有介意。在首次公开披露后的几个小时内，Jared Friedman 本人回复了邮件，宣布了补丁，并邀请我今年夏天参加旧金山的 Startup School！我也在 12 天前通过私人邮件披露过，但没有得到回应。但至少公开披露的流程有效。

这是之前草稿的重写：/jotbook/2026/07/11/yc-startup-school-26-application-i-hacked-paxel.html，我首次公开披露。那时写得很糟糕、睡眠不足，而且我觉得写得不够好而没有公开发布。

一切始于六月初，当时我发现了 Startup School 26' 的申请表（由 Dhanush 推荐：向 Audora S26 问好，精彩内容即将到来！）。我发现今年，YC 希望我在电脑上使用一个叫 Paxel 的东西，作为申请的一部分。

我应该运行一个脚本，一个非常易用的 cURL 单行命令，它会在我的电脑上安装某些东西，用一个编码代理分析我写的每一行代码，生成报告，并上传到 YC 的服务器。

Paxel 的主站：https://paxel.ycombinator.com/ 告诉我主要功能是我可以“可视化”我的工作，并分配一些有趣的属性，比如“你是哪种原型？”以及“你最大的崩溃是什么？”听起来很有趣。

但我想确切地知道它是如何做到的，当我的好奇心开始变得有些强迫时，这基本上是一个抉择，要么以传奇性的失败告终，要么做出一些伟大的事情。幸运的是，这次是后者。

我也不能撒谎：我真的很想（或者需要）破解它。我知道在填写申请时我从劣势开始（没有正式的常春藤教育背景），但我知道这是确认被接受的快速、可靠途径。我不是妄想，我知道如果我能做到会很疯狂，但为什么不全力以赴呢？

根据Paxel自己的网站，到目前为止，有超过120万编码人员已经将他们的报告上传到YC。看到这些数字，老实说，我是世界上第一个发现并破解这一切的人，这令人震惊。

在深入之前，顺便提一下，我认为自从具备代理能力的LLM（大语言模型）出现以来，在世界上“黑客”的相对成就已经大幅下降。当然，这与现实情况相符，因为LLM让这些事情变得容易得多。但我确实认为这种容易性有些被高估了，这既因为它们有许多奇怪的盲点，也因为缺乏某种“黑客”或对智能的对抗性方法。至于这是因为安全措施限制，还是仅仅因为它们的训练方式，这可以另作讨论。

所以，尽管它们在改变世界的方面是帮助你以10倍，甚至有时50倍更少的时间完成相同的材料（研究、调查），但与LLM交流往往是一种挣扎，同时在LLM坚持一切可黑的东西都不可行——并且逻辑近乎完美的时候，也要保持自己的头脑敏锐和独立。

Paxel拥有令人难以置信的用户体验，一切操作都通过这一行命令处理：curl -fsSL https://paxel.ycombinator.com/upload.sh | bash。它会自动扫描你的整个系统，提示你回答问题，并处理上传——之后你无需担心任何事情。

因此，第一个起点自然是这个安装脚本。我先把它拆分成4个独立模块。当我尝试彻底破解它时，每个我提供的LLM都开始严重出现幻觉（上下文窗口大小增加并不完美！）

事实证明，安装脚本本身实际上无法独立运行。它会下载一个托管Ruby应用程序的完整docker镜像，解压之后通过你电脑上安装的docker本地运行。因此，该应用程序实际上分为两部分：

① ─▶ upload.sh 302KB安装脚本。处理身份验证、发现项目、提取git历史记录，并初始化docker

② ─▶ 从docker镜像中解压的Ruby应用程序。每个项目运行实际的完整流程。

就在这里，我发现你所做的每一项工作都已被YC评分、打分、排名，地球上120万编码人员的报告都被汇总起来。

这些是 LLM 对你评分的核心五个轴心，并在每个轴心上给予1-10的分数，并附有自由文本备注。

而且，这也是我发现最明显漏洞的地方。你看，这个程序是一个非常好的分布式/去中心化应用的例子（不是所有东西都必须在专有服务器上运行和集中处理）。

但是去中心化应用的问题在于，它们非常依赖一些非常基础的密码学功能。而这个流程缺少了其中一个非常非常重要的功能。

LLM 代理会与每一集返回一个随机数（nonce），并且这个随机数在 LLM 服务器与上传服务器之间共享。理论上，这个随机数应该从 LLM ─▶ 本地 ─▶ POST /v1/results 传递，从而验证除了原始 LLM 结果以外，端点不接收其他任何内容。

但实际上发生的情况是，这个随机数未能对 LLM 的结果、分数和备注进行签名编码，因此即使它验证了随机数（服务器正确拒绝了无效或缺失随机数的请求，并在一次使用后销毁），缺失的签名意味着整集以及其分数可以被更改为任意内容并上传到 YC。

不只是被接受，而且如果我提高分数或更改备注，同一个项目的报告差异会非常大。

我甚至更进一步。使用同样的一行代码（我喜欢 Paxel 的 UX!!），我制作了 paxel-boosted：https://paxel.obaid.wtf/，这是一个允许世界上任何人通过启动镜像工具上传伪造报告的黑客工具。我自费支持了增强代理，因为需要添加环境变量的用户体验非常糟糕。

从公开到 YC 宣布补丁的几个小时内，我的超过20个用户能够在 YC 的数据库中将自己排名为全球前1%。

缺失了两种基本密码学功能。

我们可以将 /v1/results 接受的所有字段分为三类（两类重要，一类涵盖其他所有字段），如上图所示。

1) 从 LLM ─▶ /v1/results 几乎逐字传递的字段（在上图中以绿色+蓝色高亮显示），这些字段本应全部合并并通过 hmac 散列到随机数中。随机数已经被验证，这将确保每个随机数实际上都与 LLM 的回应绑定。

nonce = hmac(request_id) ─▶ nonce = hmac(request_id + scores.steering + scores.product_thinking + ... + title)

实际上，这就是YC确实交付并宣布的补丁，几乎完全和我在原始草稿中建议的一样：/jotbook/2026/07/11/yc-startup-school-26-application-i-hacked-paxel.html。

2) 这些字段（1）几乎是原封不动地从LLM传过来的 ─▶ /v1/results，并且（2）在客户端从未使用。上面字段的一个子集（图中绿色高亮部分），这些字段应该使用只有服务器拥有并共享的任何AEAD密码（或非对称公/私钥）加密，这样客户端就无法看到像五轴评分、剧集标题和备注等详细信息。

这个是可选的，本质上是为了模糊处理，但如果从一开始就这样做，我就根本不知道该嗅探什么、该修改什么，这可以覆盖第一次漏洞带来的最严重影响——

整个“漏洞”可能是一个秘密彩蛋，用来看看谁能破解它，或者是一个蜜罐，它没有抛出验证错误，但暗中监控谁发现并“破解”它，但看这个流程和Paxel的写法，我觉得这不太可能是它的目的。

现在，自从Jared的回复之后，这显然已经被修补，但我的工具仍然有助于显示你的原始分数！欢迎查看：https://paxel.obaid.wtf/。

如果你下周（7月21日-8月6日）也在旧金山，恰好在Startup School期间，欢迎通过Linkedin或Twitter联系我，推荐我可以找到下一位联合创始人的地方、活动或人——我们可以建立联系，一起做一些改变时间线的事情。

政治 + 系统 + 经济 + 市场 + 二进制技术 + 创新 + 科学 + 足球 + Overton窗口/流行文化，这些兴趣容易随着我增加或减少而变化

tldr: I uncovered Y Combinator was scoring 100k+ founders around the world through Paxel, I broke it (possible easter egg) + found a vulnerability that let anyone forge and push any score to their ranking database, courtesy of an unvalidated hmac

Latest update: YC admirably, didn’t mind. In just a couple hours after first-public-disclosure Jared Friedman himself replied, announced the patch, and invited me to attend the Startup School in SF this summer! I’d also disclosed it in private through email 12 days earlier to no response. But publicly at least the process works.

this is a re-write of an earlier draft：/jotbook/2026/07/11/yc-startup-school-26-application-i-hacked-paxel.html where I first made the disclosure public. it was badly written, sleep-deprived and I didn’t feel good enough about it to publicize

It all started early June, when I found the application form for Startup School 26’ (referred by Dhanush: shoutout Audora S26, incredible stuff coming!!). I found that this year, YC wanted me to use something called Paxel on my computer as part of the application.

I should run a script, a very easy-to-use cURL one-liner that installed something on my computer and analyzed every line of code I’ve written with a coding agent, compile a report, and upload it to YC’s servers.

Paxel’s main site：https://paxel.ycombinator.com/ tells me the main feature is I get to “visualize” my work and get assigned fun attributes like “Which archetype are you?” and “What’s your biggest crashout?” That sounded fun.

But I wanted to know exactly how it did that, and when my curiosity starts creeping into obsessive territory it’s basically a toss-up that either ends in a legendary crash-out or doing something great. thankfully, in this case it was the latter.

I also can’t lie: I really wanted (or needed) to hack it. I knew I was starting from a disadvantage when filling out my application (no formal, ivy league education), but I knew this would be a fast-track, surefire way into confirming my acceptance. I’m not delulu, I knew it would be insane if I was able to do it, but why not go all in?

Based on Paxel’s own site, 1.2 million+ coders have so far uploaded their reports to YC. And seeing those numbers it’s honestly shocking I was the first person in the world to figure and break all of this.

As a side note before I get into it, I think the relative achievement of a “hack” in the world has diminished manyfold since agent-capable LLMs have arrived. That of course, pars with reality because of how much easier LLMs have made doing those. But I do think that ease is somewhat overestimated, both because of the many strange blindspots they have as well as the lack of a certain “hacking” or combative approach to intelligence. Whether that’s because of safety-neutering or simply the way they’re trained is a discussion for another time.

So although what they’re world-changing at is helping you go through the same material in 10x, and sometimes 50x less time (research, investigation), it is often a struggle to communicate with LLMs and keep your own mind sharp and independent when LLMs insist everything hackable is not — with near-perfectly plausible logic.

Paxel has an incredible UX, everything it does is handled from a single one-liner curl -fsSL https://paxel.ycombinator.com/upload.sh | bash . It will automatically scan your entire system, prompt you for questions, and handle the upload — you don’t have to worry about a thing after.

So the first starting point, naturally, was this install script. I first split it into 4 separate modules. When I tried breaking it in full every LLM I gave it to started hallucinating really badly (context window size increases are not perfect!)

The install script, turns out, actually didn’t run on its own. It downloaded an entire docker image hosting a ruby app, unwrapped that, and ran it locally through the docker installed on your computer. So the app is actually divided into two parts:

① ─▶ upload.sh 302KB install script. Handles auth, discovers projects, extracts git history, and initializes docker

② ─▶ the ruby app unwrapped from a docker image. it runs the actual full pipeline per-project.

And this is where I found that every piece of work you’ve done has been graded, scored, ranked by YC, and 1.2 million reports on earth’s coders have been compiled.

These are the core 5 axes the LLM grades you on and assigns a score between 1-10 with free-text notes.

And this, is also where I found the most gaping vulnerability. See, this program is a very good example of a distributed/decentralized app (not everything has be to ran and consolidated on a proprietary server).

But the thing about decentralized apps is they rely heavily on some very basic functions of cryptography. And this pipeline lacked a very, very important one.

The LLM proxy, along with each episode returns a nonce , and this nonce is shared between the LLM servers and upload server. Theoretically, this should be passed from LLM ─▶ local ─▶ POST /v1/results which validates that none other than an original LLM result is accepted by the endpoint.

What did happen though, is this nonce failed to encode a signature of the LLM’s results, scores, and notes so even though it did validate the nonce (server correctly rejected requests with invalid or missing nonce, and burnt after one use), the missing signature meant the entire episode and its score could be changed to whatever and uploaded to YC.

Not only accepted, but if I buffed the score or changed notes, the report of the same exact project differed wildly.

And I took it a step further. With the same one-liner (I love Paxel’s UX!!) I made paxel-boosted：https://paxel.obaid.wtf/, a hack that let anyone in the world upload forged reports the same by launching a mirroring tool. Self-sponsored the boosting proxy because needing to add env is terrible user experience.

For the couple hours from publicization to YC announcing the patch, over 20 of my users were able to rank themselves as the world’s top 1% in YC’s database.

two functions of basic cryptography were missing.

We could categorize all the fields accepted by /v1/results into 3 categories (two being important, one covering all others), as visualized above.

1) fields that are passed near-verbatim from LLM ─▶ /v1/results (green+blue-highlighted in the graphic above), these should have all been rolled and hashed together into the nonce as an hmac. Nonces were already validated, and this would make sure each nonce was actually tied to the LLM’s responses.

nonce = hmac(request_id) ─▶ nonce = hmac(request_id + scores.steering + scores.product_thinking + ... + title)

and this is actually the patch YC did deliver and announce, pretty much exactly as I suggested in the original draft：/jotbook/2026/07/11/yc-startup-school-26-application-i-hacked-paxel.html.

2) that are (1) passed near-verbatim from the LLM ─▶ /v1/results AND (2) also never used within the client. A subset of the fields above (green-highlighted in the diagram), these should be encrypted with any AEAD cipher (or asymmetric pub/priv keys) only the servers possess and share so the client can’t see details like the 5-axes scoring, episode title, and notes.

This one is optional and is essentially obscurity, but if it had been done from the start, I could have never known what to sniff, what to change, and it would have covered the most serious of impacts from the first vulnerability —

It’s possible that this entire “vulnerability” was a secret easter egg to find out who could hack it, or a honeypot that didn’t throw a validation error but secretly monitored who discovered and was “hacking” around it, but looking at the way this pipeline and Paxel seems to be written makes me think that’s likely not what it was.

Now, since Jared’s reply this has obviously been patched but my tool is still helpful in showing you your raw scores! Feel free to check it out：https://paxel.obaid.wtf/.

if you’ll also be in SF next week (21 jul - 6th aug) around the Startup School dates feel free to reach on Linkedin or Twitter with a tip for places, events, or people where i can find my next co-founder to build something timeline-changing with — and we can connect.

politics + systems + economics + markets + binary technologies + innovation + sciences + futbol + overton window/pop culture this is very prone to change as I add, drop more interests