Codex scraped the ICM website and discovered 2026 Fields Medal winner list

Post by [deleted] » Tue, Jul 14, 2026, 3:18 PM UTC

resonious wrote: post #10

edoceo wrote: post #8

I've been working on a site. It's new, domain is only a few weeks old. It's got SSL, so all the bots know it exists. It's never had any sub-pages exposed, just the placeholder lander, no links. Somehow in Google search one of the unguessable pages is indexed. We have used Claude and Gemini to assist with some design aspects. I'm thinking some aggressive data ingestion/indexing is happening by all the bots in the ques…

I've also seen Google indexing pages with random values in the path that don't get linked to statically (server asks for the URL then redirects to it immediately). I'm pretty sure they index straight out of the Chrome address bar.

Post by throw10920 » Tue, Jul 14, 2026, 3:34 PM UTC

edoceo wrote: post #102

throw10920 wrote: post #36

Earlier quoted context omitted.

They would not - GP was probably bringing up something not directly relevant, but still related. (they should have clarified though)

What can I add? I know the domain could be found. But how did Google index a page that is example.com/$MD5.html - guessing 128bit numbers is hard. I have visited that page from a signed-in Chrome profile.

Post by pohuing » Tue, Jul 14, 2026, 3:52 PM UTC

fragmede wrote: post #24

pohuing wrote: post #22

Earlier quoted context omitted.

There's a couple avenues besides just stealing what's in your URL bar. If you don't use wildcard certs all of your subdomains can be scraped from the certificate transparency logs. Additionally, any domain+cert using HSTS with preload enabled end up in a big list at Google to speed up the initial connection from browser to site.

CT logs just explain how they found the domain. T doesn't explain how they could have found unlinked content on the domain itself. If I put up secret-example.com/asdf-1234567.html, how does that page get found if there are no public links to it?

Post by NuclearPM » Tue, Jul 14, 2026, 5:15 PM UTC

FabCH wrote: post #104

evilduck wrote: post #78

Earlier quoted context omitted.

I'll take a wild guess and assume they are of a German or Polish language background. Wait 'til you encounter a French person who accidentally uses guillemets if you want one even «weirder».

Correct. Swiss German keyboard.

Post by ApolloFortyNine » Tue, Jul 14, 2026, 6:58 PM UTC

bronson wrote: post #80

sixtyj wrote: post #27

> The leak occurred when four Fields Medal laureate lecture fields, marked "HIDDEN," were discovered in the front-end code of the ICM 2026 official schedule. So it was easier than I thought. Bot just scraped public page with hidden fields, not a secret page or to-be-published page from database.

I'm tired of the framing in the media these days. "Mythos will end the world!!" "How?" "By finding a bunch of wide open security holes that have existed for years." Oookay. Is this a Mythos problem? Or a lazy/greedy/uncaring people problem?