{"slug": "using-genius-ai-models-for-important-things-cheating-at-nethack", "title": "Using Genius AI Models for Important Things: Cheating at NetHack", "summary": "Using GPT-5.6 Daybreak Blue, a player found an integer-truncation bug in NetHack 5's resize_tty() function, enabling an on-demand crash to duplicate items and achieve a high score of 29,926,212 points on the NAO (nethack.alt.org) NetHack 5.0 leaderboard. The bug was patched by NAO developer dtype, with the player credited on the main page.", "body_md": "This is how I used GPT-5.6 Daybreak Blue to find a buffer overflow, crash the game in order to dupe items, and get the high score on the NetHack 5.0 leaderboard.\n\nI love NetHack. It’s such an awesome game. And I love hacking/bug hunting. So when I met Demo (aka [turb0](https://x.com/7urb01)), who is an epic bug bounty hunter and has ascended NetHack (and variants) around 300 times, I asked him a million questions.\n\nMy favorite thing he told me about was how he’d do a “hacked run” nearly every year at [Junethack](https://junethack.net/), the annual NetHack tournament. He would show off the bugs he found during the previous year and use them to break the game in some way.\n\nI wanted to do that too! But I’m not nearly as good at deep white-box vulns as he is. Luckily, top AI models finally are. So I set GPT-5.6 Daybreak Blue on the hunt. Within a few hours, it found an **ideal crash**. It could be induced at any time rather than only during specific actions.\n\n*Daybreak Blue coming back with: “Yes, this is real.”*\n\n### The crash\n\nNetHack 5 had an integer-truncation bug in [ resize_tty()](https://github.com/k21971/NAO-5.x/blob/3aa4ab31751d3886436d94b585a96704892fd477/win/tty/wintty.c#L392-L411): terminal widths above 32,767 wrapped negative, leading to an undersized allocation and out-of-bounds write. Resizing to 65,529 columns and back reliably crashed the game.\n\nThat was unusually powerful because it gave players an on-demand crash at any exact moment. During a level transition, NetHack saved the departing level before updating its global checkpoint. We dropped an item, descended, paused at `--More--`\n\n, and triggered the crash. Recovery then combined the new level file, containing the dropped item, with the old global state, where it was still in inventory. The result was a duplicate, including charged wands of wishing and unique artifacts.\n\nCrazily enough, Demo had hypothesized an issue here in the past.\n\n*Demo was asking exactly the right question a year earlier.*\n\n### The live chain\n\nI reproduced the complete chain on live NAO. You can see where they fixed it [here](https://github.com/k21971/dgamelaunch/commit/1a6653f0c3ba8e44e297f4e394952603ab45d734), followed by a [fix for a bypass in the original patch](https://github.com/k21971/dgamelaunch/commit/9e055c3108f69e34a87ad57e06c555bcd635446e). I was credited on the main page.\n\nShoutout to dtype, the dev who fixed it.\n\n*Thanks, NAO!*\n\n[NAO](https://www.alt.org/nethack/) (nethack.alt.org) is the major server where most people play. The other main one is [Hardfought](https://www.hardfought.org/nethack/), but NAO is kind of a more vanilla server. All the wishes, deaths, and ascensions there get posted in [IRC](https://www.alt.org/nethack/irc.php).\n\nDuping wishes and making tons of wishes is naturally very noisy. Other players were annoyed and started tagging devs. The devs got to fixing it before I used the best and easiest way to rack up an insane score: duping dilithium crystals.\n\n*Other players starting to notice: “I don’t understand how all of that is possible.”*\n\nThey patched it, and I didn’t have enough wishes to wish for tons of dilithium crystals, but I had lots of scrolls and wishes. So I wished for magic markers and wrote cursed scrolls of genocide so that I could later reverse genocide (summon) lots of krakens. Krakens give the most experience, so I could farm them for experience instead.\n\n*A completely normal number of cursed scrolls of genocide.*\n\nKrakens are the red semicolons.\n\n*Every red semicolon is a kraken.*\n\n### The high score\n\nAnyways, I eventually got the [high score](https://www.alt.org/nethack/top-5.0.php).\n\n*29,926,212 points. Number one on NAO’s NetHack 5.0 leaderboard.*\n\n*Rodney announcing the result in IRC.*\n\nThe full [dumplog is here](https://www.alt.org/nethack/userdata/r/rez0bot/dumplog/1786710983.nh500.txt).\n\nThis is the kind of important work genius hacking models were made for :P Also, the nethack server NAO is awesome and they let hacked runs like this live on in infamy on the leaderboard. Thanks to Demo for the inspiration, and to the NAO devs (mostly dtype) for being so cool about everything.\n\n- Joseph\n\n[Sign up for my email list](https://thacker.beehiiv.com/subscribe) to know when I post more content like this.\n\nI also [post my thoughts on Twitter/X](https://x.com/rez0__).", "url": "https://wpnews.pro/news/using-genius-ai-models-for-important-things-cheating-at-nethack", "canonical_source": "https://josephthacker.com/hacking/2026/08/20/using-genius-hacking-models-for-important-things.html", "published_at": "2026-08-20 14:22:17+00:00", "updated_at": "2026-08-20 14:46:17.782525+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-tools", "ai-research"], "entities": ["GPT-5.6 Daybreak Blue", "NetHack 5", "NAO", "dtype", "Demo", "turb0", "Junethack", "Hardfought"], "alternates": {"html": "https://wpnews.pro/news/using-genius-ai-models-for-important-things-cheating-at-nethack", "markdown": "https://wpnews.pro/news/using-genius-ai-models-for-important-things-cheating-at-nethack.md", "text": "https://wpnews.pro/news/using-genius-ai-models-for-important-things-cheating-at-nethack.txt", "jsonld": "https://wpnews.pro/news/using-genius-ai-models-for-important-things-cheating-at-nethack.jsonld"}}