16 comments

[ 0.24 ms ] story [ 37.1 ms ] thread
Someone used Codex to scrape the ICM website schedule and discovered that the winners list was simply hidden in the front-end code with a "hidden" tag

This is on the devs and feels like a very basic leak which could have exploited in the non LLM world as well.

It's Wang Hong, my god. Cannot they still don't write proper Chinese names?
This is sad, almost as sad as the Deathly Hallows pre-release leak.
> Hong Wang will become the third female mathematician in history to receive the Fields Medal

Interestingly, if true, it will also be the first time an MIT PhD graduate has won the Fields Medal.

I've been working on a site. It's new, domain is only a few weeks old. It's got SSL, so all the bots know it exists. It's never had any sub-pages exposed, just the placeholder lander, no links.

Somehow in Google search one of the unguessable pages is indexed. We have used Claude and Gemini to assist with some design aspects.

I'm thinking some aggressive data ingestion/indexing is happening by all the bots in the quest for frontier models.

twist: codex also wrote the code that placed the winners list in a hidden element
too bad that those winners can no longer bet themselves on polymarket as the winner and make big money.
> The leak occurred when four Fields Medal laureate lecture fields, marked "HIDDEN," were discovered in the front-end code of the ICM 2026 official schedule.

So it was easier than I thought. Bot just scraped public page with hidden fields, not a secret page or to-be-published page from database.

First of all congrats to the winners.

Second, fitting that codex enters the picture.

The last time the fields medals were announced llms were still very nascent :)

And I am convinced this is the last time pure human fields medalists will be announced.

The next batch’s winners are all going to have llms as coauthors.

This is like when a news site throws up a paywall and hides half the article. Open inspector. Select the body, delete the overflow/scroll capture styles, delete the masks... and boom there is the entire article. Only some sites are smart enough to actually truncate the content server-side.
really tacky of the finders to disclose the names.
(comment deleted)