This is how I used GPT-5.6 Daybreak Blue to find a buffer overflow, crash the game in order to dupe items, and get the high score on the NetHack 5.0 leaderboard.
I love NetHack. It’s such an awesome game. And I love hacking/bug hunting. So when I met Demo (aka turb0), who is an epic bug bounty hunter and has ascended NetHack (and variants) around 300 times, I asked him a million questions.
My favorite thing he told me about was how he’d do a “hacked run” nearly every year at Junethack, the annual NetHack tournament. He would show off the bugs he found during the previous year and use them to break the game in some way.
I wanted to do that too! But I’m not nearly as good at deep white-box vulns as he is. Luckily, top AI models finally are. So I set GPT-5.6 Daybreak Blue on the hunt. Within a few hours, it found an ideal crash. It could be induced at any time rather than only during specific actions.
Daybreak Blue coming back with: “Yes, this is real.”
The crash
NetHack 5 had an integer-truncation bug in resize_tty(): terminal widths above 32,767 wrapped negative, leading to an undersized allocation and out-of-bounds write. Resizing to 65,529 columns and back reliably crashed the game.
That was unusually powerful because it gave players an on-demand crash at any exact moment. During a level transition, NetHack saved the departing level before updating its global checkpoint. We dropped an item, descended, paused at --More--, and triggered the crash. Recovery then combined the new level file, containing the dropped item, with the old global state, where it was still in inventory. The result was a duplicate, including charged wands of wishing and unique artifacts.
Crazily enough, Demo had hypothesized an issue here in the past.
Demo was asking exactly the right question a year earlier.
The live chain
I reproduced the complete chain on live NAO. You can see where they fixed it here, followed by a fix for a bypass in the original patch. I was credited on the main page.
Shoutout to dtype, the dev who fixed it.
Thanks, NAO!
NAO (nethack.alt.org) is the major server where most people play. The other main one is Hardfought, but NAO is kind of a more vanilla server. All the wishes, deaths, and ascensions there get posted in IRC.
Duping wishes and making tons of wishes is naturally very noisy. Other players were annoyed and started tagging devs. The devs got to fixing it before I used the best and easiest way to rack up an insane score: duping dilithium crystals.
Other players starting to notice: “I don’t understand how all of that is possible.”
They patched it, and I didn’t have enough wishes to wish for tons of dilithium crystals, but I had lots of scrolls and wishes. So I wished for magic markers and wrote cursed scrolls of genocide so that I could later reverse genocide (summon) lots of krakens. Krakens give the most experience, so I could farm them for experience instead.
A completely normal number of cursed scrolls of genocide.
Krakens are the red semicolons.
Every red semicolon is a kraken.
The high score
Anyways, I eventually got the high score.
29,926,212 points. Number one on NAO’s NetHack 5.0 leaderboard.
Rodney announcing the result in IRC.
The full dumplog is here.
This is the kind of important work genius hacking models were made for :P Also, the nethack server NAO is awesome and they let hacked runs like this live on in infamy on the leaderboard. Thanks to Demo for the inspiration, and to the NAO devs (mostly dtype) for being so cool about everything.
- Joseph
Sign up for my email list to know when I post more content like this.
I also post my thoughts on Twitter/X.
