How AI-Assisted Systems Are Changing Bug-Bounty Hunting

Summary

The speaker demonstrates an AI-assisted bug-bounty workflow finding authentication and authorization flaws in controlled labs. He argues AI can surface leads quickly, while a researcher’s methodology and judgment remain important.

Key points

• The speaker uses a custom AI skill, built from his past reports and methodology, to test controlled lab applications alongside his own work.
• In the Pulse lab demonstration, the API exposed user data and a reset flow; the AI used these clues to reach an admin account and access secrets.
• In another lab, the AI found JWT verification issues involving alg none and RS256-to-HS256 key confusion.
• A separate lab demonstrated mass assignment: the application merged request fields that enabled elevated account privileges.
• In the cargo flow lab, an internal RPC role-grant function let a customer session become ops admin; the demo showed cross-tenant customer data exposure.
• The speaker says both the base model and his report-informed skill solved the exercises, but the custom skill used about 20,000 more tokens. He argues prior methodology may help surface less obvious leads, which a human must assess.
• His testing approach includes examining login flows, APIs, and JavaScript for authorization assumptions; he recommends scoped testing and describes using separate attacker and victim accounts.