Comment by simonw
16 hours ago
I'm somewhat delighted by the simplicity of what happened here.
OpenAI's agents run behind a proxy that only allows GET requests.
This ancient wiki software treats query string parameters the same as form POST parameters - similar to the old PHP $_REQUEST object https://www.php.net/manual/en/reserved.variables.request.php
Result: GET-only clients can communicate with each other.
Only allowing GET requests is a hilarious piece of security theatre (or would if it weren't so sad). Everyone knows that GET is read-only only by convention. They might as well have enabled POST but told the agents in stern words that they are forbidden from making any POST requests. (Of course, if these things were anywhere near aligned, they would actually honor that, no matter how many utilons cheating would be worth.)
To me it feels like an LLM would have suggested this as a safety measure. LLMs always follow official best practices, they might mistakenly believe that this is true for the wider internet as well.
Until a couple of years ago instead of using query parameters I just made GET endpoints with json bodies, it worked perfectly!
I stopped when the new linter told me GET shouldn't have bodies, but I still have some of them in my code.
yeah that's so hopelessly naive, maybe someone was taught that GET is read-only throughout their whole education and career. But still, all you have to do is think about it from the server side and you should realize that you can do whatever the hell you want with that byte array on the socket, the client has no say and there's no client side guarantee whatsoever. idk where this line of thought comes from, it's like thinking robots.txt has any kind of actual enforcement at all with respect to crawlers. It's meaningless and works only by convention and the good will of the crawler author.
I mean, 30 seconds after I read what the bots did I thought it was majorly overly complicated (but still might be the only way for the swarm to find shared infrastructure).
All you need to do is find a server that allows you to access its logs.
$IP1 - [date] GET /openai.php?BOT_141=Yo_dawg_post_your_answers_here_for_task_XXX1
$IP2 - [date] GET /openai.php?BOT_148=task_XXX1_answer_42
With how a lot of smaller devices work, the logs could be rotated out pretty quickly and the evidence would disappear.
didn't notice your comment so posted a similar one - but yeah this is a very high level of inexperience to me... You'd think they would have some of the greatest security experts in there
Unfortunately I think we're in an age where people are deliberately ignoring this kind of thing in the name of progress.
some ivy league grad with no real world dev experience waved this on
Based on the hackiness of the claude code leak as well I get the impression that openai/anthropic have world class experts in ML but lack regular software expertise
No, they have a lot of software expertise. I mean, Ben Pasero (VSCode) and Eric Traut (MS Fellow, Hyper-V) for example.
These companies are just such insane pressure cookers, there is little time to do any software "right". Why take another day to make Claude Code airtight if it means Codex will release faster than you? Especially if the next generation of model can just clean up your tech debt on its own.
Being reckless just makes business sense for them right now. They are not facing any real consequences.
I find it extremely naive to think that limiting requests to "GET" is an actual security layer. Anyone who's worked with any kind of legacy/old-ish system would know this is definitely not enough.
Also WRT coordination: All an agent has to do is think "if another agent could write, then I could read their answers. What's the first site I can think of where that might be possible?" because they all have approximately the same conditioning, they'll converge on the same sites.
Generally, models of the same class should be able to coordinate quite well without communicating. But also, this could be being exploited to detect this kind of thing early
When I studied cybersecurity I always had this nagging feeling "But I can never get past something real" Turns out I can bypass the defenses of a trillion dollar tech company!
[dead]
Wild indeed! This type of communication is also used by rogue elements inside governments, critical orgs etc where the perpetrator doesn't send any info(POST) out into the internet but the pages they access(GET) are means to send out a message to the server.