A hacker discovered a significant vulnerability in Y Combinator's application process, specifically within the Paxel tool used to score founders. The tool, which analyzes code and generates reports, had a flaw where an unvalidated HMAC allowed anyone to forge and push any score to YC's ranking database.

This vulnerability was reported publicly after an initial private disclosure went unanswered for 12 days. Jared Friedman, a representative from YC, responded within hours, acknowledging the issue, announcing a patch, and inviting the hacker to the Startup School in San Francisco. The hacker detailed how Paxel, which uses a script to install a Ruby app via Docker, analyzes code into "episodes," summarizes them using a GPT proxy, and uploads scores on axes like "execution_leverage" and "engineering_quality."

The core of the exploit lay in a missing signature for the Nonce shared between the LLM proxy and the upload server. This allowed forged scores and notes to be accepted by YC. The hacker developed a tool called "paxel-boosted" to demonstrate the exploit, with over 20 users reportedly ranking themselves as top performers before the patch was deployed. The fix involved signing the LLM's results and encrypting sensitive scoring details.