Obaid hacks YC's Paxel founder rankings, gets Startup School invite

Why it matters

The breach shows that a single security flaw in YC's applicant analytics can distort founder rankings, highlighting the urgent need for hardened APIs in accelerator tools.

In early June 2026, an independent developer known as Obaid (@wtfobaid) uncovered a critical flaw in Y Combinator’s proprietary scoring tool, Paxel. Paxel, which applicants for the accelerator must run locally, gathers a developer’s entire git history, feeds it to a hosted LLM, and returns a report that YC uses to rank candidates on five axes – execution leverage, steering, engineering quality, product thinking, and planning. The tool’s public site describes the service as a way to “visualize” work and assign fun attributes like "Which archetype are you?" and "What’s your biggest crashout?" link.

Obaid reverse‑engineered the one‑liner installer (curl -fsSL https://paxel.ycombinator.com/upload.sh | bash) and found that it pulls a Docker image containing a Ruby app. The app authenticates, extracts git data, sends it to a free GPT‑5.5 proxy hosted at paxel-llm.ycombinator.com, receives a scored summary, and posts the result to paxel.ycombinator.com/api/v1/results. The scores – each a 1‑10 rating with free‑text notes – are stored in a ranking database that Obaid was able to write to directly because the API verified requests only with an HMAC that was not validated on the server side.

By crafting their own HMAC, Obaid demonstrated that any user could forge a score and push it into YC’s ranking system. The author claimed that "1.2 million+ coders have so far uploaded their reports to YC" – a figure taken from Paxel’s own statistics page – and that he was the first person to discover and exploit the vulnerability.

Obaid posted a public disclosure on July 11, 2026, linking to the vulnerable endpoint and describing the exploit. Within hours, Y Combinator partner Jared Friedman (@snowmaker) responded on X, confirming the bug, announcing a patch, and extending an invitation to attend the Summer 2026 Startup School in San Francisco. The exchange is captured in Friedman’s tweet, which includes a screenshot of his reply:

Friedman’s reply read: "Impressive hacking! Sorry for all the hopefuls out there, but we have patched the bug :). Obaid - thanks for reporting the issue. Look forward to seeing you at Startup School in SF in two weeks!" The tweet was posted at 10:23 AM on July 11, 2026.

Obaid had initially emailed YC about the issue twelve days earlier with no response. The public disclosure prompted a rapid fix, illustrating how a single security oversight in a high‑stakes founder‑selection pipeline can be leveraged to alter perceived applicant quality.

The episode raises broader questions about the security of automated evaluation tools used by accelerators and venture firms. Paxel’s architecture – a client‑side script that uploads raw code data to a proprietary LLM service and then writes scores to a central database – relies on minimal server‑side validation. As Obaid noted, the rise of powerful LLMs has lowered the barrier to building such pipelines, but it also introduces new attack surfaces that can be exploited by relatively unsophisticated actors.

Y Combinator’s swift response – patching the HMAC verification and publicly acknowledging the contribution – suggests an awareness of reputational risk. By inviting the researcher to Startup School, YC turned a potential embarrassment into a goodwill gesture, reinforcing its image as a founder‑friendly organization that values security disclosures.

For the startup ecosystem, the incident underscores the importance of third‑party security audits for any tool that influences fundraising or admission decisions. As more accelerators adopt AI‑driven analytics, the need for rigorous code review and hardened APIs will become a competitive differentiator.

Obaid’s disclosure also serves as a reminder that “hacking” can still be a pathway to credibility within the tech community, even in an era where large language models automate much of the exploratory work. The author’s willingness to dive into the internals of a closed‑source system, expose a flaw, and publicly demonstrate its impact offers a case study in how independent security research can intersect with startup recruitment pipelines.