Codex scraped the ICM website and discovered 2026 Fields Medal winner list
A leak of the alleged 2026 Fields Medal winners emerged after an AI-assisted code-scraping tool pulled names from “hidden” elements in the public HTML of the International Congress of Mathematicians website. Commenters argue this was a basic web development failure rather than sophisticated hacking, while noting that AI lowers the barrier to finding such mistakes and raises questions about how authorities treat individuals who expose them. The thread widens into concerns over privacy and data collection by browsers and AI services, and touches on cultural issues such as the handling of Chinese name order and the ethics of publicizing the winners in advance.
How the leak happened
- The Fields Medal winners were embedded in the public ICM 2026 schedule HTML, marked as “hidden” in the front-end rather than protected server-side.
- Commenters note this is a very basic web leak that could have been found pre-LLM with “view source” or simple scraping.
- Some compare it to paywalled articles that simply hide text with CSS instead of not serving it.
Role of LLMs vs traditional scraping
- One side argues the “Codex discovered it” angle is overhyped; the root cause is poor web development and basic security mistakes.
- Others counter that while humans could do it, LLMs change scale and accessibility, making such discoveries easier and more likely.
- There’s debate over whether crediting the model is meaningful if the task is trivial.
Legal and ethical concerns
- Several comments highlight past cases where people who responsibly disclosed simple flaws were threatened with prosecution, especially under broad anti-hacking laws.
- Others say these extreme responses are not the norm, though security researchers still feel they must be cautious.
- Some find it “tacky” that the discoverers publicly revealed the winners’ names early.
Privacy, Chrome, and hidden URLs
- A long tangent discusses how “unguessable” URLs or draft pages get indexed by Google despite no public links.
- Theories include Chrome sending visited URLs back to Google, Cloudflare “crawler hints,” sitemaps/CMS behavior, analytics scripts, DNS logs, browser “safe browsing” checks, or even compromised extensions.
- Some insist Chrome-derived URL data is real and was documented in antitrust proceedings; others are alarmed by the implication but see it as consistent with big-tech surveillance patterns.
Naming and transliteration debate
- There’s a side discussion on Chinese name order (family name first vs Westernized order).
- Some argue media should follow the person’s own usage; others say transliteration and ordering are inherently messy and context-dependent.
Broader AI/security implications
- Several comments stress that LLMs may rapidly surface long-standing “obvious” bugs and leaks, changing the security landscape by scale rather than by novelty.
- Others push back on media framing that blames “AI” rather than the underlying human-made vulnerabilities.