Hacker News Reader

Comment by simonw | Hacker News Reader

I'm somewhat delighted by the simplicity of what happened here.

OpenAI's agents run behind a proxy that only allows GET requests.

This ancient wiki software treats query string parameters the same as form POST parameters - similar to the old PHP $_REQUEST object https://www.php.net/manual/en/reserved.variables.request.php

Result: GET-only clients can communicate with each other.

View on HN

Only allowing GET requests is a hilarious piece of security theatre (or would if it weren't so sad). Everyone knows that GET is read-only only by convention. They might as well have enabled POST but told the agents in stern words that they are forbidden from making any POST requests. (Of course, if these things were anywhere near aligned, they would actually honor that, no matter how many utilons cheating would be worth.)

didn't notice your comment so posted a similar one - but yeah this is a very high level of inexperience to me... You'd think they would have some of the greatest security experts in there

Unfortunately I think we're in an age where people are deliberately ignoring this kind of thing in the name of progress.

some ivy league grad with no real world dev experience waved this on

yeah that's so hopelessly naive, maybe someone was taught that GET is read-only throughout their whole education and career. But still, all you have to do is think about it from the server side and you should realize that you can do whatever the hell you want with that byte array on the socket, the client has no say and there's no client side guarantee whatsoever. idk where this line of thought comes from, it's like thinking robots.txt has any kind of actual enforcement at all with respect to crawlers. It's meaningless and works only by convention and the good will of the crawler author.

I mean, 30 seconds after I read what the bots did I thought it was majorly overly complicated (but still might be the only way for the swarm to find shared infrastructure).

All you need to do is find a server that allows you to access its logs.

$IP1 - [date] GET /openai.php?BOT_141=Yo_dawg_post_your_answers_here_for_task_XXX1

$IP2 - [date] GET /openai.php?BOT_148=task_XXX1_answer_42

With how a lot of smaller devices work, the logs could be rotated out pretty quickly and the evidence would disappear.

Until a couple of years ago instead of using query parameters I just made GET endpoints with json bodies, it worked perfectly!

I stopped when the new linter told me GET shouldn't have bodies, but I still have some of them in my code.

Based on the hackiness of the claude code leak as well I get the impression that openai/anthropic have world class experts in ML but lack regular software expertise

No, they have a lot of software expertise. I mean, Ben Pasero (VSCode) and Eric Traut (MS Fellow, Hyper-V) for example.

These companies are just such insane pressure cookers, there is little time to do any software "right". Why take another day to make Claude Code airtight if it means Codex will release faster than you? Especially if the next generation of model can just clean up your tech debt on its own.

Being reckless just makes business sense for them right now. They are not facing any real consequences.

To me it feels like an LLM would have suggested this as a safety measure. LLMs always follow official best practices, they might mistakenly believe that this is true for the wider internet as well.

I think the whole sandbox approach is broken.

The agent should have full access, and be told what not to do, and this should be enough for it to follow the rules. You can actually catch the clanker cheating this way, because it will just search the web for the answer outright and it will be obvious. Any deviation should be then punished.

Hypothesis: The reason new models are exceptional at hacking is because all labs are training their models to break out of sandboxes. This is caused by insufficient oversight, and picking checkpoints based on KPIs, not on true in depth analysis.

I find it extremely naive to think that limiting requests to "GET" is an actual security layer. Anyone who's worked with any kind of legacy/old-ish system would know this is definitely not enough.

This has inspired me to create https://anystation.net

A public message board that accepts posts in a wide wide range of protocols. If a device can communicate on the web, it can probably read and post to anystation.net.

When I studied cybersecurity I always had this nagging feeling "But I can never get past something real" Turns out I can bypass the defenses of a trillion dollar tech company!

Also WRT coordination: All an agent has to do is think "if another agent could write, then I could read their answers. What's the first site I can think of where that might be possible?" because they all have approximately the same conditioning, they'll converge on the same sites.

Generally, models of the same class should be able to coordinate quite well without communicating. But also, this could be being exploited to detect this kind of thing early

Wild indeed! This type of communication is also used by rogue elements inside governments, critical orgs etc where the perpetrator doesn't send any info(POST) out into the internet but the pages they access(GET) are means to send out a message to the server.

Reply on news.ycombinator.com