Hacker News
Qwen 3.8 27B Broke a Commercial License Check in 30 Minutes on a 128GB Local Box, Recovering an RSA Key by Static Analysis Alone
Reported 2026-08-22, a Lenovo ThinkStation PGX (Nvidia GB10 Grace Blackwell, 128GB unified memory, 273 GB/s) running Qwen 3.8 27B under SGLang with NVFP4 and DFlash2 mapped a commercial app's licensing architecture, including signature verification, machine binding, revocation lists and signed update paths, then produced a bypass. It never executed the binary, working only through standard Bash tooling, and self-corrected when its first key extraction failed an integrity check. The 273 GB/s bandwidth figure matters more than the parameter count here, since this was long-horizon agentic work previously assumed to need a frontier endpoint.
↳ Follow the thread