Against better judgement, I ran it on my repo. Poking at the "Ask anything about the report" bot, it penalizes me heavily for not having "positive tracked outcomes", as I don't report back to Claude what the outcome is. It wanted me to do this:
"At the end of research-heavy sessions, add a tiny closure note:
Decision:
Use CacheMountStore with registry/local/GHA backends.
Why:
GHA cannot expose the same content.Ingester path, local import has discovery issues, registry can resolve by tag.
Proof / current artifact:
See files X, Y, Z. Subagent found A, B, C.
Next action:
Implement interface in package N. Do not add new cache-mount flags yet. Use mode=cache-mount on existing cache flags."
There's no need for this, Claude is not my task tracker.
It also penalized me for:
- Using Claude to introspect a codebase as throwaway work and ` not close with a crisp “acceptable / risky / copy this / avoid this” decision this session.`. No action was needed, it wasn't an actionable session!
- Using Fable for code review. `Several BuildKit subagent sessions produced research reports, but the transcript does not show whether those findings became implementation choices.` Yes, Fable launches subagents to code review. Valid findings get turned into fixes or WONTFIX.
- `The Cloudflare CI upload failure got narrowed well, especially after you supplied the exact timestamp and challenged the /v2 routing recommendation, but the session ended without a chosen next diagnostic owner or action this session.` There's no need to pick a next diagnostic owner when I'm a solo founder with no employees.
I'm choosing not to attach a report to my application. As a side note, nobody needs to see "my greatest crashout", it's embarrassing enough for me to see it for myself, much less show others.
I had the exact same experience. Claude is not my validation engine, I do not tell it when it has completed. I verify that in the code/project and end the session.
I also got this,
> A useful next habit is to end each correction with a concrete acceptance test, owner artifact, or stop condition: “write it into PROGRESS.md,” “make nix run .#bench fail until this is real,” “rerun this exact command,” or “do not proceed until these two choices are explicit.”
> You already do this well in the biggest penance sessions. Apply it to the smaller ones too.
Which I have found to be counterproductive in my personal work. Current models can generally infer acceptance tests of this level of granularity (not true for larger project-level prompts, but those don't produce good enough code for me yet -- even with specific acceptance criteria).
I also got penalized for using claude in read-only mode for the same validation reason?
> For read-only work, end with one of:
“turn the top finding into a PR-sized plan”
“mark these as accepted/rejected/deferred”
“write a cleanup checklist”
“give me the exact command I should run safely”
“stop, no action recommended”
No thanks, I'm literally just exploring the codebase. I don't want any of these.
It's a little sad to be honest, I would actually enjoy a product that helped me improve prompting + ai usage.
Yeah, I've found similar issues with even basic tasks like 'draft an email response' which will then populate a md file tagged as draft. Claude will then chastise me a few days later for not sending said draft. I've had to take real steps to avoid NannAIy in the last month that haven't even been a problem before in similar workflows.
This tool might be useful for AI tool beginners who need some guidance, but using it as a scoring tool looks like a mistake. It’s just going to penalize people for having different ways of working.
I don’t know how much it’s actually used to rate people. Rating anyone based on how they work instead of the results produced is an age-old mistake though.
> Based on Paxel’s own site, 1.2 million+ coders have so far uploaded their reports to YC.
I checked the Paxel website and it says this:
> So far, 1,543,553 sessions have been uploaded and analyzed.
The count is for sessions, not coders. I assume the tool uploads a lot of sessions from each person who uses it.
That’s a large number, but it’s not a million different people. I am surprised that so many people think it’s a good idea to download a run a program which gathers up their coding sessions and submits information about them.
I could be mistaken, but isn't Paxel a tool that YC *itself* built to understand how founders/applicants apply AI? If so, this feels less scary than some of the comments (i.e. not 3rd party).
Also, not trying to take shots, but should the title be "I got into YC Startup School by hacking it" instead? Isn't that different than the main YC program?
All in all, you did them a solid by finding and responsibly disclosing. Nice job.
So let me get this straight... technical founders are providing limitless access to their IP, and this is supposed to be a positive indicator that they would be a good founder? Thats wild
`cd ~/path/to/your-project && curl -fsSL https://paxel.ycombinator.com/upload.sh | bash` is the command from Paxel's website. So you're literally just piping whatever the hell they want into bash. It's long, lots of comments, and honestly would be time consuming to audit properly.
Supposedly this is what it does from the opening comment
# Paxel upload script
# ===================
#
# What this does (up to 17 steps):
# On your machine
# 1. Check Docker is installed and running
# 2. Sign you in (browser-based device auth)
# 3. Pull or build the Paxel Docker image
#
# Inside the container — file bodies stay local; only aggregate metrics +
# metadata (paths, commit numstat, session events) are uploaded
# 4. Discover projects and sessions (Claude Code, Codex CLI, Cursor)
# 5. Read your git history
# 6. Parse transcripts
# 7. Summarize each session (cloud Haiku via YC proxy)
# 8. Group git commits by session
# 9. Group sessions into multi-day work streams
# 10. Extract steering traces
# 11. Extract decision exchanges (cloud Haiku)
# 12. Redact code before upload (regex pattern redaction)
# 13. Link decisions to outcomes
# 14. Analyze code quality (L1 deterministic)
# 15. Score episodes across 5 axes (cloud Haiku)
# 16. Assemble your report
# 17. Upload redacted summaries + scores to the server
#
# Then: opens your results in the browser
For the longest time, the YC application included the question "What was your greatest (non-computer) hack?". They have always liked people who think of ways to work around existing systems. So it's no surprise that their response was positive. Also, all the principals are ex-founders, mostly engineers, who totally understand hacking culture.
Sadly, it looks like they took that question off the application though.
Am I misreading this, or is ycombinator running a tool that transfers IP from an applicant’s machine to OpenAI and then transfers the generated summaries into their own servers. And that tool has some “webapp security 101” level vulnerability in it.
It doesn’t upload code (it’s not meant to, anyway); it uploads coding agent transcripts. It’s meant to be a fun app like Spotify wrapped - that’s how it was described when presented internally.
Sure - though that’s all generated by the coding agents. So it shouldn’t be uploading original hand-written code (unless the coding agent is running on a legacy codebase).
Obviously it’s not something everyone is going to be comfortable sharing, but YC is transparent about what is shared and how it’s used.
Edit:
I now see you have to explicitly run it in every directory you want shared - i.e., it doesn’t t scan your whole disk looking for stuff to upload. So there’s every opportunity to limit what it uploads to only what you want to share.
It's very common nowadays to claim that something doesn't have access to X when it does in fact have system level access to X, but the application code just doesn't use X (or a prompt is being asked not to use X).
Trustworthy people will ask you to give them the right amount of access, they won't ask you for infinite access and ask you to trust them that they won't use it. Would you trust a contractor that asks for root, and your master password when they could have requested a specific user or some specific files?
Sure - and people are able to audit what the software is doing and call it out if it’s operating in a way that’s unintended or inappropriate, just as has happened here.
Edit:
I’ll add this point as people always seem to want to raise the spectre of YC or the AI platforms stealing people’s code or ideas via these sorts of tools.
The value of any code or ideas is immaterial compared to the value of identifying talented people who can then be offered opportunities such as attending Startup School, being funded by YC, getting jobs at YC-funded companies or YC itself.
It’s one of pg’s oldest dictums, that ideas alone are worthless, and only working products and the people that build them are worth anything. Nobody at YC thinks any differently about that these days.
>>Sure - and people are able to audit what the software is doing and call it out if it’s operating in a way that’s unintended or inappropriate, just as has happened here
1. Yes you can audit client side and network interface, but not server side.
2. does 'curl $URL | sh' invite users to audit? Or to trust blindly? It's the equivalent of presenting a contract with 'sign here' stickers and pushing you to sign it quickly like it's nothing. Does not signal trustworthiness.
>I’ll add this point as people always seem to want to raise the spectre of YC or the AI platforms stealing people’s code or ideas via these sorts of tools.
>The value of any code or ideas is immaterial compared to the value of identifying talented people who can then be offered opportunities such as attending Startup School, being funded by YC, getting jobs at YC-funded companies or YC itself.
>It’s one of pg’s oldest dictums, that ideas alone are worthless, and only working products and the people that build them are worth anything. Nobody at YC thinks any differently about that these days.
I do agree and share this point, ideas are worthless. But this doesn't deal with ideas, it deals with code, which as a software startup I don't feel the need to convince you of its value and the risks of leaking it. If you think your code is worthless, close your startup.
By many definitions, prompts are source code, and what we used to call source code is now target code. So this indeed does leak your source code. It's not just an IP blunder to leak your source code this carelessly, but it's a security blunder to do so. "But Kerchoff's principle.." no, Kerchoff's principle is that you should design your system as if source code were public, not that leaking source code has no negative security effect.
Also, is it possible that YC is taking advantage of the 'your ideas are worthless' dictum? Just share your ideas with YC, they are too big to care about your stupid idea. But they are gathering intel on over hundred of thousands of startups, and the ratio of applicants to fundings is continuously going down.
And sharing your idea with a single potential investor, isn't the same thing as submitting your idea (and implementation details), to a system built by people who don't give a shit about internals or security, and that use third party tools and services from different countries to process your data in ways that they don't give a fuck either.
What guarantee do you have that by using YC's vibecode data gathering tool, your data won't end up in a training set that will make it easier for a competitor with the same idea as you to find your solution?
A decade ago maybe your idea was worthless and joining YC was a contrarian bet. Nowadays, this data is clearly worth something, and applying to YC is as mainstream as applying for a job, and both of these mainstream 'apply for a 0.1% chance at the privilege of working with us' tend to grow completely asymmetric and exploit the underdog as much as they allow themselves to be exploited.
It doesn’t deal with code, it deals with chat transcripts, and only those in the directories you explicitly choose to share (yes I know transcripts include some code but you’re not sharing a working app codebase or anything close to it).
The entire purpose of Startup School for YC is to build great relationships with the most promising talent. The scale and cost of the event is vast, and the benefits for attendees are huge.
It’s a three day event with main-stage interviews with several top figures in the tech world and many other intimate events with YC partners, industry experts and fellow attendees. Much of the effort in organizing the event is maximizing the chances that attendees will meet other attendees with things in common so they can build relationships and maybe work on important projects in the future. Of course, YC hopes to be able to fund the most promising startups that come out of this, but nobody is obligated to apply to YC or take YC funding if it’s offered.
What I’m trying to convey here is that it’s in YC’s utmost interests to build trust and earn respect from the people who are participating in these programs, and there is no way in a million years that some code or implementation detail exposed in a chat transcript is going to be more valuable than building very positive, mutually trusting relationships with all participants and applicants over the long term.
>It doesn’t deal with code, it deals with chat transcripts, and only those in the directories you explicitly choose to share (yes I know transcripts include some code but you’re not sharing a working app codebase or anything close to it).
What's more important, the code? or the source?
It's the source. The mistake thousands of people are making is that the source no longer looks like code, and the target code now looks like what source code used to be. They are looking at the aesthetics instead of the fundamentals.
You ignored the rest of my comment. The maximum theoretical benefit to YC from “stealing” IP or trade secrets from chat transcripts is immaterial, relative to the benefit to YC of finding good talent and building positive, trusting relationships with them over the long term.
It's literally the hardest thing in business for investors and employers by far: finding good talent to invest in or employ, and earning/keeping their trust. YC spends unimaginable amounts of money and effort each year to keep doing that, as it has done for two decades. Startup School is just that latest and biggest example of that.
It doesn't even pass basic logic that YC would steal some gem of an idea from someone's transcript and hand it to someone else to build. Everyone who is talented enough to build it is busy building products based on their own ideas, and the very best person to build a product is the person who had the idea to build it.
One of the threat models is not YC itself stealing your IP. Which they are to some extent, but them using vendors that themselves train their models on your IP. Or vendors that use vendors that...
>YC spends unimaginable amounts of money and effort each year to keep doing that, as it has done for two decades.
Yeah, that or they built their reputation early on and are now coasting on that. It's an industry whose explicit objective is to build companies (build reputations) and then exit and sell them, would you be surprised if YC itself did that?
>It doesn't even pass basic logic that YC would steal some gem of an idea from someone's transcript and hand it to someone else to build.
More likely is the opposite, they get 100k startup applications and they know what ideas people are pursuing and should be avoided, and which might be worth looking into. The former become would target demographics for shovel selling as well, so the 1% that actually gets into YC might setup shop selling to the other 99%. It's theoretical, but these are all attacks that emerge from the basic violation of sharing your source code. To be clear, I don't think that YC employees are starting startups, the threat model is that they act through their picks, and they strengthen their picks at the expense of their non-picks. It's like a russian roulette of startups, which isn't necessarily a bad idea.
>Everyone who is talented enough to build it is busy building products based on their own ideas,
Like, I get that, but also don't overcorrect into the naïve take that market intelligence is worthless or doesn't exist, especially when that take is 20 years old, if you treat that as your strategic advantage over the population, it's more likely that it's going to be used to take advantage of you.
Be moderate, share your idea, don't share everything. Share to individuals, don't share to massive data gathering systems that may use your data as training data for machine learning models. Basic stuff really.
The users have already shared their ideas with an AI company’s chatbot. The “IP” you’re worried about is already more than half the output of LLM chatbots and it could already be trained on.
Everything you’re speculating about regarding YC’s potential to steal ideas, along with the notion that they are “coasting”, is easily disproven by what YC is doing, literally right now.
Startup School 2026 is the most costly and elaborate event YC has ever presented. YC is hosting about 7500 people at the event, and entertaining them (meals, parties, small-group sessions and dinners) and paying for flights for many of them from elsewhere in the country and world. They recently did a similar thing in India, and are constantly running outreach events at colleges around the world. That’s in addition to running four YC accelerator batches per year, funding nearly 1000 companies annually (and hoping to grow that).
This is the opposite of “coasting” and is completely at adds with any notion what YC really wants to do is steal IP or ideas. YC’s business collapses if it loses the trust of the most promising talent.
Took a look at Paxel. It's worth noting that we have the client target code to analyze only, I could not find server side code, nor source prompts for the client code, if any of those could be provided it would make auditing easier.
Also, I appreciate that it's probably all fine, and that my attack scenarios are mostly theoretical, and that YC took care in developing security measures for Paxel, and that maybe I'm paranoid.
But I believe in a security model that doesn't rely just on trust, but on system level guarantees, where we install things not by running 'curl $URL | bash', but by robust technologies like OAuth. Yes, maybe it's a bit harder to build, and the 'UX' of installing these things will not be as clean. I'm just not on board with the piping curl into bash fad. I'm sure there's a sweetspot of trustingness and scrutiny.
To take some heat off YC, they are not the only ones, consider socket.dev, a security product, they tell you that they will not read your code, only the requirements.txt and package.json type of files, but when you install it, GitHub gives them full access to repos, we have had file level permissions for years, but suddenly it's not possible to request that level of granulairty for permissions.
I'm sure that there's a sweetspot between trustworthiness and rigour, but 'curl|bash' and 'deputyless permissions' is clearly on the too-trustworthy end of the spectrum, fantastically so, it makes me feel the overton window is shifting towards extremist levels of disregard for security.
But maybe I'm wrong, I'd love to read a defense of 'curl|bash', 'give the agent access to all the company data' and 'you can just ask the LLM to not read some data'.
Identifiers included in uploaded data. Information you upload to use the Services may include personal identifiers such as your name and email address (including names and email addresses of repository contributors), as well as other identifiers that may appear in commit metadata, file paths, transcripts, or other uploaded materials.
AI coding-agent transcript-derived content. Per-session narratives, certain session events including file paths and truncated command text, prompt excerpts, steering traces, and dispatch metadata. This data may include local file paths (e.g., directory structures such as /Users/…) and other contextual information that could be associated with an individual. Raw conversation history, full prompts, full agent responses, and full tool outputs do not leave your machine.
Information you upload may include Personal Information relating to other individuals (for example, repository contributors). You represent that you have the necessary rights and permissions to provide such information to us for processing in connection with the Services.
Usage patterns and activity intervals. We may derive and store information about your usage patterns, such as session timing and working-hour intervals, based on timestamps associated with your activity.
> I uncovered Y Combinator was scoring 100k+ founders around the world through Paxel
Alright, my ears are wide open. Tell us more, how did YC use the private submission data from thousands of founders to score them? They fed some 3rd-Party AI all personal data to score who should get an interview? I can't be the only one here seeing a bad news story unfolding in real time...
YC is currently polarizing against companies that are rejecting the philosophy of giving (a single user) AI full read access to company data. They find that resistance frustrating and the complain publicly about it, calling such an attitude outdated "so 2024".
I understand that YC and startups in general have less incentive to worry about security because they don't have much to lose. But I think the big winners will care about security from the start, because it's a bottleneck at the top, what would whatsapp be if they vibecoded security from day 1? It would never have been able to fix its reputation after the fact.
They then switch the topic and talk about token spend and how one can spend millions or billions of dollars in tokens, so it's a bit clearer what their incentives are.
I don't want to be negative and personal, but this is business, I listen to CEOs like Garry Tan and Satya Nadella, and I feel that I'm on an opposing team, my personal bet is to skip this cycle and wait for the next cycle of CEOs. I'm focusing a lot on security on this cycle, hopefully that will pay off.
> YC wanted me to use something called Paxel on my computer as part of the application.
> I should run a script, a very easy-to-use cURL one-liner that installed something on my computer and analyzed every line of code I’ve written with a coding agent, compile a report, and upload it to YC’s servers.
the sad thing is that paxel sounds like it would be a pretty fun tool to run locally and see what my LLM assisted code gets classified as. instead, to borrow cory doctorow's framing, it is designed to do something to me rather than for me.
> instead, to borrow cory doctorow's framing, it is designed to do something to me rather than for me.
That's nice framing. I believe the goal of American business culture (in general) is to do a much to users as possible, and do as little for users as they can get away with. Silicon Valley is the dumb partner who tends to say the quiet part loud.
It can't possibly be an inevitable future. Something this would be super easy to game.
From their perspective, it's code running on an untrusted third person/adversary's computer... If only last 40 years of computer history could be any guide as to what might go wrong here
..
most VCs aren’t founders and those who are ex-founders usually made pretty terrible companies. very few exceptions. actually i can think of only one.
but once you have some money (like >5m which is achievable), you can throw it around a bit and you just need a handful of success stories built by someone actually talented.
then you take credit for it and craft a narrative instead, which is easier just like collecting management fees instead of building something yourself.
Don't worry, it doesn't analyze your generated code, it just analyzes your source prompts, the thing that presumably generates the code. If only there was a word for text that generates a computer program.
Oh, I remember that thing, it wanted to see my prompt and my code in exchange for telling me my horoscope.
Some hands you have to fold, and I'm folding this one. Patiently waiting for the "let's give all our data to a single AI user" bubble to bust with some massive exploits.
This is how you end up with gstack. When you believe too hard in secret metrics because when people know about metrics it stops working you inflict psychosis chasing correlations that don't mean anything.
> I found that this year, YC wanted me to use something called Paxel on my computer as part of the application.
> I should run a script, a very easy-to-use cURL one-liner that installed something on my computer and analyzed every line of code I’ve written with a coding agent, compile a report, and upload it to YC’s servers.
This is ridiculous. Any kind of application (job, startup school, whatever) should not do this. Honestly, wtf is YC thinking with this?
Against better judgement, I ran it on my repo. Poking at the "Ask anything about the report" bot, it penalizes me heavily for not having "positive tracked outcomes", as I don't report back to Claude what the outcome is. It wanted me to do this:
"At the end of research-heavy sessions, add a tiny closure note:
Decision: Use CacheMountStore with registry/local/GHA backends.
Why: GHA cannot expose the same content.Ingester path, local import has discovery issues, registry can resolve by tag.
Proof / current artifact: See files X, Y, Z. Subagent found A, B, C.
Next action: Implement interface in package N. Do not add new cache-mount flags yet. Use mode=cache-mount on existing cache flags."
There's no need for this, Claude is not my task tracker.
It also penalized me for:
I'm choosing not to attach a report to my application. As a side note, nobody needs to see "my greatest crashout", it's embarrassing enough for me to see it for myself, much less show others.I had the exact same experience. Claude is not my validation engine, I do not tell it when it has completed. I verify that in the code/project and end the session.
I also got this,
> A useful next habit is to end each correction with a concrete acceptance test, owner artifact, or stop condition: “write it into PROGRESS.md,” “make nix run .#bench fail until this is real,” “rerun this exact command,” or “do not proceed until these two choices are explicit.”
> You already do this well in the biggest penance sessions. Apply it to the smaller ones too.
Which I have found to be counterproductive in my personal work. Current models can generally infer acceptance tests of this level of granularity (not true for larger project-level prompts, but those don't produce good enough code for me yet -- even with specific acceptance criteria).
I also got penalized for using claude in read-only mode for the same validation reason?
> For read-only work, end with one of:
No thanks, I'm literally just exploring the codebase. I don't want any of these.It's a little sad to be honest, I would actually enjoy a product that helped me improve prompting + ai usage.
Yeah, I've found similar issues with even basic tasks like 'draft an email response' which will then populate a md file tagged as draft. Claude will then chastise me a few days later for not sending said draft. I've had to take real steps to avoid NannAIy in the last month that haven't even been a problem before in similar workflows.
This tool might be useful for AI tool beginners who need some guidance, but using it as a scoring tool looks like a mistake. It’s just going to penalize people for having different ways of working.
I don’t know how much it’s actually used to rate people. Rating anyone based on how they work instead of the results produced is an age-old mistake though.
It's used for YC applications as an optional portion of the founders profile. I'm not sure how it's weighted.
> Based on Paxel’s own site, 1.2 million+ coders have so far uploaded their reports to YC.
I checked the Paxel website and it says this:
> So far, 1,543,553 sessions have been uploaded and analyzed.
The count is for sessions, not coders. I assume the tool uploads a lot of sessions from each person who uses it.
That’s a large number, but it’s not a million different people. I am surprised that so many people think it’s a good idea to download a run a program which gathers up their coding sessions and submits information about them.
"They trust me."
I feel so tempted to post the next two words that famously follow that utterance.
I could be mistaken, but isn't Paxel a tool that YC *itself* built to understand how founders/applicants apply AI? If so, this feels less scary than some of the comments (i.e. not 3rd party).
Also, not trying to take shots, but should the title be "I got into YC Startup School by hacking it" instead? Isn't that different than the main YC program?
All in all, you did them a solid by finding and responsibly disclosing. Nice job.
So let me get this straight... technical founders are providing limitless access to their IP, and this is supposed to be a positive indicator that they would be a good founder? Thats wild
`cd ~/path/to/your-project && curl -fsSL https://paxel.ycombinator.com/upload.sh | bash` is the command from Paxel's website. So you're literally just piping whatever the hell they want into bash. It's long, lots of comments, and honestly would be time consuming to audit properly.
Supposedly this is what it does from the opening comment
What is cloud Haiku? Did they mean Claude Haiku?
No.
It uploads only the AI coding agent transcripts in the directories you explicitly run the upload script in.
[flagged]
For the longest time, the YC application included the question "What was your greatest (non-computer) hack?". They have always liked people who think of ways to work around existing systems. So it's no surprise that their response was positive. Also, all the principals are ex-founders, mostly engineers, who totally understand hacking culture.
Sadly, it looks like they took that question off the application though.
That question is still there, it lives in the founder profile.
Except this was a computer hack. So technically wouldn't qualify.
Sure, I wasn't saying it would. I was saying that the question on the application demonstrates YC's acceptance of this type of creativity.
Why does the author keep mentioning that a one line bash command that downloads a bunch of crap is “great UX”?
Am I misreading this, or is ycombinator running a tool that transfers IP from an applicant’s machine to OpenAI and then transfers the generated summaries into their own servers. And that tool has some “webapp security 101” level vulnerability in it.
Feels like a disaster waiting to happen.
It doesn’t upload code (it’s not meant to, anyway); it uploads coding agent transcripts. It’s meant to be a fun app like Spotify wrapped - that’s how it was described when presented internally.
But to generate those transcripts the tool does upload your code to an LLM of its choosing
;)
Right, and you have to pay for the privilege :)
Those transcripts generally contain code edit diffs.
Sure - though that’s all generated by the coding agents. So it shouldn’t be uploading original hand-written code (unless the coding agent is running on a legacy codebase).
Obviously it’s not something everyone is going to be comfortable sharing, but YC is transparent about what is shared and how it’s used.
Edit:
I now see you have to explicitly run it in every directory you want shared - i.e., it doesn’t t scan your whole disk looking for stuff to upload. So there’s every opportunity to limit what it uploads to only what you want to share.
It's very common nowadays to claim that something doesn't have access to X when it does in fact have system level access to X, but the application code just doesn't use X (or a prompt is being asked not to use X).
>curl -fsSL https://paxel.ycombinator.com/upload.sh | bash
Point in case.
Trustworthy people will ask you to give them the right amount of access, they won't ask you for infinite access and ask you to trust them that they won't use it. Would you trust a contractor that asks for root, and your master password when they could have requested a specific user or some specific files?
Sure - and people are able to audit what the software is doing and call it out if it’s operating in a way that’s unintended or inappropriate, just as has happened here.
Edit:
I’ll add this point as people always seem to want to raise the spectre of YC or the AI platforms stealing people’s code or ideas via these sorts of tools.
The value of any code or ideas is immaterial compared to the value of identifying talented people who can then be offered opportunities such as attending Startup School, being funded by YC, getting jobs at YC-funded companies or YC itself.
It’s one of pg’s oldest dictums, that ideas alone are worthless, and only working products and the people that build them are worth anything. Nobody at YC thinks any differently about that these days.
>>Sure - and people are able to audit what the software is doing and call it out if it’s operating in a way that’s unintended or inappropriate, just as has happened here
1. Yes you can audit client side and network interface, but not server side.
2. does 'curl $URL | sh' invite users to audit? Or to trust blindly? It's the equivalent of presenting a contract with 'sign here' stickers and pushing you to sign it quickly like it's nothing. Does not signal trustworthiness.
>I’ll add this point as people always seem to want to raise the spectre of YC or the AI platforms stealing people’s code or ideas via these sorts of tools.
>The value of any code or ideas is immaterial compared to the value of identifying talented people who can then be offered opportunities such as attending Startup School, being funded by YC, getting jobs at YC-funded companies or YC itself.
>It’s one of pg’s oldest dictums, that ideas alone are worthless, and only working products and the people that build them are worth anything. Nobody at YC thinks any differently about that these days.
I do agree and share this point, ideas are worthless. But this doesn't deal with ideas, it deals with code, which as a software startup I don't feel the need to convince you of its value and the risks of leaking it. If you think your code is worthless, close your startup.
By many definitions, prompts are source code, and what we used to call source code is now target code. So this indeed does leak your source code. It's not just an IP blunder to leak your source code this carelessly, but it's a security blunder to do so. "But Kerchoff's principle.." no, Kerchoff's principle is that you should design your system as if source code were public, not that leaking source code has no negative security effect.
Also, is it possible that YC is taking advantage of the 'your ideas are worthless' dictum? Just share your ideas with YC, they are too big to care about your stupid idea. But they are gathering intel on over hundred of thousands of startups, and the ratio of applicants to fundings is continuously going down.
And sharing your idea with a single potential investor, isn't the same thing as submitting your idea (and implementation details), to a system built by people who don't give a shit about internals or security, and that use third party tools and services from different countries to process your data in ways that they don't give a fuck either.
What guarantee do you have that by using YC's vibecode data gathering tool, your data won't end up in a training set that will make it easier for a competitor with the same idea as you to find your solution?
A decade ago maybe your idea was worthless and joining YC was a contrarian bet. Nowadays, this data is clearly worth something, and applying to YC is as mainstream as applying for a job, and both of these mainstream 'apply for a 0.1% chance at the privilege of working with us' tend to grow completely asymmetric and exploit the underdog as much as they allow themselves to be exploited.
It doesn’t deal with code, it deals with chat transcripts, and only those in the directories you explicitly choose to share (yes I know transcripts include some code but you’re not sharing a working app codebase or anything close to it).
The entire purpose of Startup School for YC is to build great relationships with the most promising talent. The scale and cost of the event is vast, and the benefits for attendees are huge.
It’s a three day event with main-stage interviews with several top figures in the tech world and many other intimate events with YC partners, industry experts and fellow attendees. Much of the effort in organizing the event is maximizing the chances that attendees will meet other attendees with things in common so they can build relationships and maybe work on important projects in the future. Of course, YC hopes to be able to fund the most promising startups that come out of this, but nobody is obligated to apply to YC or take YC funding if it’s offered.
What I’m trying to convey here is that it’s in YC’s utmost interests to build trust and earn respect from the people who are participating in these programs, and there is no way in a million years that some code or implementation detail exposed in a chat transcript is going to be more valuable than building very positive, mutually trusting relationships with all participants and applicants over the long term.
>It doesn’t deal with code, it deals with chat transcripts, and only those in the directories you explicitly choose to share (yes I know transcripts include some code but you’re not sharing a working app codebase or anything close to it).
What's more important, the code? or the source?
It's the source. The mistake thousands of people are making is that the source no longer looks like code, and the target code now looks like what source code used to be. They are looking at the aesthetics instead of the fundamentals.
You ignored the rest of my comment. The maximum theoretical benefit to YC from “stealing” IP or trade secrets from chat transcripts is immaterial, relative to the benefit to YC of finding good talent and building positive, trusting relationships with them over the long term.
It's literally the hardest thing in business for investors and employers by far: finding good talent to invest in or employ, and earning/keeping their trust. YC spends unimaginable amounts of money and effort each year to keep doing that, as it has done for two decades. Startup School is just that latest and biggest example of that.
It doesn't even pass basic logic that YC would steal some gem of an idea from someone's transcript and hand it to someone else to build. Everyone who is talented enough to build it is busy building products based on their own ideas, and the very best person to build a product is the person who had the idea to build it.
One of the threat models is not YC itself stealing your IP. Which they are to some extent, but them using vendors that themselves train their models on your IP. Or vendors that use vendors that...
>YC spends unimaginable amounts of money and effort each year to keep doing that, as it has done for two decades.
Yeah, that or they built their reputation early on and are now coasting on that. It's an industry whose explicit objective is to build companies (build reputations) and then exit and sell them, would you be surprised if YC itself did that?
>It doesn't even pass basic logic that YC would steal some gem of an idea from someone's transcript and hand it to someone else to build.
More likely is the opposite, they get 100k startup applications and they know what ideas people are pursuing and should be avoided, and which might be worth looking into. The former become would target demographics for shovel selling as well, so the 1% that actually gets into YC might setup shop selling to the other 99%. It's theoretical, but these are all attacks that emerge from the basic violation of sharing your source code. To be clear, I don't think that YC employees are starting startups, the threat model is that they act through their picks, and they strengthen their picks at the expense of their non-picks. It's like a russian roulette of startups, which isn't necessarily a bad idea.
>Everyone who is talented enough to build it is busy building products based on their own ideas,
Like, I get that, but also don't overcorrect into the naïve take that market intelligence is worthless or doesn't exist, especially when that take is 20 years old, if you treat that as your strategic advantage over the population, it's more likely that it's going to be used to take advantage of you.
Be moderate, share your idea, don't share everything. Share to individuals, don't share to massive data gathering systems that may use your data as training data for machine learning models. Basic stuff really.
The users have already shared their ideas with an AI company’s chatbot. The “IP” you’re worried about is already more than half the output of LLM chatbots and it could already be trained on.
Everything you’re speculating about regarding YC’s potential to steal ideas, along with the notion that they are “coasting”, is easily disproven by what YC is doing, literally right now.
Startup School 2026 is the most costly and elaborate event YC has ever presented. YC is hosting about 7500 people at the event, and entertaining them (meals, parties, small-group sessions and dinners) and paying for flights for many of them from elsewhere in the country and world. They recently did a similar thing in India, and are constantly running outreach events at colleges around the world. That’s in addition to running four YC accelerator batches per year, funding nearly 1000 companies annually (and hoping to grow that).
This is the opposite of “coasting” and is completely at adds with any notion what YC really wants to do is steal IP or ideas. YC’s business collapses if it loses the trust of the most promising talent.
Took a look at Paxel. It's worth noting that we have the client target code to analyze only, I could not find server side code, nor source prompts for the client code, if any of those could be provided it would make auditing easier.
Also, I appreciate that it's probably all fine, and that my attack scenarios are mostly theoretical, and that YC took care in developing security measures for Paxel, and that maybe I'm paranoid.
But I believe in a security model that doesn't rely just on trust, but on system level guarantees, where we install things not by running 'curl $URL | bash', but by robust technologies like OAuth. Yes, maybe it's a bit harder to build, and the 'UX' of installing these things will not be as clean. I'm just not on board with the piping curl into bash fad. I'm sure there's a sweetspot of trustingness and scrutiny.
To take some heat off YC, they are not the only ones, consider socket.dev, a security product, they tell you that they will not read your code, only the requirements.txt and package.json type of files, but when you install it, GitHub gives them full access to repos, we have had file level permissions for years, but suddenly it's not possible to request that level of granulairty for permissions.
I'm sure that there's a sweetspot between trustworthiness and rigour, but 'curl|bash' and 'deputyless permissions' is clearly on the too-trustworthy end of the spectrum, fantastically so, it makes me feel the overton window is shifting towards extremist levels of disregard for security.
But maybe I'm wrong, I'd love to read a defense of 'curl|bash', 'give the agent access to all the company data' and 'you can just ask the LLM to not read some data'.
Founder/CEO of Socket here.
If you have a suggestion for how to scope down the permissions of our app, we’re all ears. But based on our research, it’s not possible.
More info documenting each permission: https://docs.socket.dev/docs/permissions
for sure, "fun" is definitely the vibe:
Identifiers included in uploaded data. Information you upload to use the Services may include personal identifiers such as your name and email address (including names and email addresses of repository contributors), as well as other identifiers that may appear in commit metadata, file paths, transcripts, or other uploaded materials.
AI coding-agent transcript-derived content. Per-session narratives, certain session events including file paths and truncated command text, prompt excerpts, steering traces, and dispatch metadata. This data may include local file paths (e.g., directory structures such as /Users/…) and other contextual information that could be associated with an individual. Raw conversation history, full prompts, full agent responses, and full tool outputs do not leave your machine.
Information you upload may include Personal Information relating to other individuals (for example, repository contributors). You represent that you have the necessary rights and permissions to provide such information to us for processing in connection with the Services.
Usage patterns and activity intervals. We may derive and store information about your usage patterns, such as session timing and working-hour intervals, based on timestamps associated with your activity.
https://paxel.ycombinator.com/privacy
AI can do no wrong.
Maybe this is another one of Garry's 30k LOC/day vibecode specials that he's so proud of
> I uncovered Y Combinator was scoring 100k+ founders around the world through Paxel
Alright, my ears are wide open. Tell us more, how did YC use the private submission data from thousands of founders to score them? They fed some 3rd-Party AI all personal data to score who should get an interview? I can't be the only one here seeing a bad news story unfolding in real time...
YC is currently polarizing against companies that are rejecting the philosophy of giving (a single user) AI full read access to company data. They find that resistance frustrating and the complain publicly about it, calling such an attitude outdated "so 2024".
https://youtu.be/B246K_G7mHU?si=UVJei9Jpk7ZvREnH&t=1483
https://youtu.be/B246K_G7mHU?si=ikHZD4MwxA5JtXLj&t=1716
I understand that YC and startups in general have less incentive to worry about security because they don't have much to lose. But I think the big winners will care about security from the start, because it's a bottleneck at the top, what would whatsapp be if they vibecoded security from day 1? It would never have been able to fix its reputation after the fact.
They then switch the topic and talk about token spend and how one can spend millions or billions of dollars in tokens, so it's a bit clearer what their incentives are.
I don't want to be negative and personal, but this is business, I listen to CEOs like Garry Tan and Satya Nadella, and I feel that I'm on an opposing team, my personal bet is to skip this cycle and wait for the next cycle of CEOs. I'm focusing a lot on security on this cycle, hopefully that will pay off.
ceo of vc firm and ceo of msft
have different priorities
sure….
> YC wanted me to use something called Paxel on my computer as part of the application.
> I should run a script, a very easy-to-use cURL one-liner that installed something on my computer and analyzed every line of code I’ve written with a coding agent, compile a report, and upload it to YC’s servers.
Yikes! I hope this is NOT the future of hiring.
the sad thing is that paxel sounds like it would be a pretty fun tool to run locally and see what my LLM assisted code gets classified as. instead, to borrow cory doctorow's framing, it is designed to do something to me rather than for me.
> instead, to borrow cory doctorow's framing, it is designed to do something to me rather than for me.
That's nice framing. I believe the goal of American business culture (in general) is to do a much to users as possible, and do as little for users as they can get away with. Silicon Valley is the dumb partner who tends to say the quiet part loud.
It can't possibly be an inevitable future. Something this would be super easy to game.
From their perspective, it's code running on an untrusted third person/adversary's computer... If only last 40 years of computer history could be any guide as to what might go wrong here ..
most VCs aren’t founders and those who are ex-founders usually made pretty terrible companies. very few exceptions. actually i can think of only one.
but once you have some money (like >5m which is achievable), you can throw it around a bit and you just need a handful of success stories built by someone actually talented.
then you take credit for it and craft a narrative instead, which is easier just like collecting management fees instead of building something yourself.
How is 5m easy to achieve? Asking for a friend.
I don't think he ever said it was "easy"
Everytime you think this it will be. Let's go back to analog.
paxel my gstack until i submit
its for G brain types
you wouldn’t understand
For those like me who didn't understand the reference: https://github.com/garrytan/gbrain
wtfffff
what do you think it says if you don't use AI
It only uploads your AI agent transcripts, so if you don’t use AI there’s nothing to upload.
Which indeed tells them something about you.
I should hope! It's something I'd want known. Not something I think they'd like though. ...but being outside the mainstream can also have its benefits
Don't worry, it doesn't analyze your generated code, it just analyzes your source prompts, the thing that presumably generates the code. If only there was a word for text that generates a computer program.
So if you built something without the use of an LLM, you’re automatically disqualified now? What a world.
Don't read this horror story before bed time if you care about information security.
Perhaps running the script outside a heavily sandboxed system should trigger an automatic rejection.
surprised running paxel doesn't disqualify you, the program sounds sus
Oh, I remember that thing, it wanted to see my prompt and my code in exchange for telling me my horoscope.
Some hands you have to fold, and I'm folding this one. Patiently waiting for the "let's give all our data to a single AI user" bubble to bust with some massive exploits.
This is how you end up with gstack. When you believe too hard in secret metrics because when people know about metrics it stops working you inflict psychosis chasing correlations that don't mean anything.
> I found that this year, YC wanted me to use something called Paxel on my computer as part of the application.
> I should run a script, a very easy-to-use cURL one-liner that installed something on my computer and analyzed every line of code I’ve written with a coding agent, compile a report, and upload it to YC’s servers.
This is ridiculous. Any kind of application (job, startup school, whatever) should not do this. Honestly, wtf is YC thinking with this?
> (what) is YC thinking with this?
They want people who do what they say and don't challenge them?
> I’d also disclosed it in private through email 12 days earlier to no response. But publicly at least the process works.
lmao “I got into the YC Startup School by publicly embarrassing them”
“Got into YC” is being used a bit loosely here. They got invited to startup school, which is a two-day event hosted by YC.
I got into HN front page by hacking it (the post title)
Fake it until you make it, baby!
[flagged]
[dead]
[flagged]
[flagged]
paxel and how it works sounds so dumb.
so i’m not at all surprised at how it is used and by whom.
Paxel seems like a tool that would cause brand damage to YC if it were better known.