Duarte

CS major student, Security Researcher @Hacker0x01. I hack for fun whenever I have some free time.

[Duarte @0xdfr]

INSHAAAALAAAAHHHHHH

[Tibo @thsottiaux]

We are reseting usage for all paid users of Codex and ChatGPT Work.

Please continue reading for an update on Codex usage limits. The team has been working around the clock, going through thousands of reports and shipping fixes.

Depending on how you use Codex, you should see your usage go between 10% and 50% further than before.

We really went with a fine comb, with many uncovered small things being longstanding and here is what we found and fixed:
- Compaction. We were keeping old images during compaction, sometimes making the context large enough to trigger compaction again. After the fix, usage dropped around 10% for users making heavy use of images. Fixed.
- Memory. Background memory workers could inherit Stop hooks and keep running when the hook wouldn’t let them finish. This affected fewer than 1% of users, with the long tail being pretty bad and we saw one example thread check whether it could stop 15,000 times. Fixed.
- Goals. In some cases, a set /goal could finish and then keep going past the intended stop condition, or the model would keep retrying broken tools without stopping. We saw examples consume anywhere from 15% to 70% of a weekly allowance. Fixed.
- Automations. Some custom schedules could run more frequently than configured. Fixed.
- Subagents. Smaller models (e.g. Luna) sometimes picked more capable helpers without being explicitly asked. The same was true where the orchestrating model not running in /fast mode could request sub-agents to run /fast. Fixed.
- Computer History. The older implementation could lead to repeatedly summarizing overlapping activity. For some cases we saw it consume up to one fifth of the weekly usage per week. Fixed.
- Rolling task summaries. Ordinary turns were triggering extra background requests. These added about 1% to token usage. Small each time, but it adds up. We have disabled this.
- MCP. Some tool results could be encoded twice. We also found tool instructions getting cut off and fetched again. Fixed.

We’ve also made architectural changes to prevent these from regressing and our teams will get paged if it happens regardless. We are also working on showing you directly in the app where your usage goes so you don’t have to guess.

Goes without saying that we’re resetting usage limits and I hope you enjoy a very nice Saturday!

[Duarte @0xdfr]

@luq0xss @1Iucas @dk4trin @pad1ryoshi @Guga_Saas boas mano, usas sub ou api?

[Duarte @0xdfr]

Give me those private invites 🙏🙏

[Duarte @0xdfr]

@akiravine I’ll do a writeup on this soon!

[Duarte @0xdfr]

Got an XSS WAF bypass found manually. So satisfying to find things manually in this AI era

[Duarte @0xdfr]

@ElS1carius @Bugcrowd @profundisio hey man, can i ask what model and reasoning effort?

[Duarte @0xdfr]

@navalogs @Batista______ @0xPira tmj irmão, abraço de portugal

[Duarte @0xdfr]

Just unlocked an achievement at Intigriti! https://t.co/H5vgFlV9Lj #HackWithIntigriti @intigriti

[Duarte @0xdfr]

@gdb Codex really aids me during my workflow, really imporving my overall performance!

[Tibo @thsottiaux]

Oops... I did it again.

Enjoy reset usage limits for all paid users for Codex and ChatGPT Work. Super grateful for an incredible team who is iterating at lightspeed and keeping the infra up as we scale faster than ever.

Enjoy the weekend!

[Duarte @0xdfr]

@Reeshasx mano em 10 reports 9.5 são duplicados 😂

[Duarte @0xdfr]

@thsottiaux I switched cause Sol has a tendancy to have better understanding and reasoning when doing cyber related work for a big amount of time.

[Duarte @0xdfr]

the dupes this year are crazy, to see I’ve submitted 2 crits and 2 highs the last two weeks and they were all dupes…

[Tib3rius @0xTib3rius]

@gabsmashh Just gonna leave this here.

[Duarte @0xdfr]

@HabilIsl @BugBunny_ai have you got better results more recently?

[Duarte @0xdfr]

@navalogs @Batista______ @0xPira mano isto vai-te ajudar muito então https://t.co/ka3ednBH5r

[Duarte @0xdfr]

I’m in the Top 15 Portuguese Hackers on Hackerone 2026!

[Duarte @0xdfr]

how does a company have a full ATO with a leaked token marked as out of scope…..

[Duarte @0xdfr]

@evsc33 currently have the same type of report being triaged, even if its low severity, a win is a win

[Duarte @0xdfr]

@busf4ctor