AI Agent Helped Bug Bounty Hunter Find Google Flaws for Reported $500,000+

Summary

The video says researcher bootcat used an AI agent with data from Google Android apps to find access-control and exposure bugs across Google services, earning more than $500,000 in three months.

Key points

• The video reports that bootcat scraped 60,000 Google Android apps, extracted 3,600 API keys and used them to access 1,500 APIs.
• Bootcat reportedly supplied the data to Claude and configured an agent to look for broken access control.
• One finding allegedly exposed Google Fiber Voice users’ phone and account-recovery numbers through an endpoint without access checks; the reported bounty was $20,000.
• The video says a Widevine flaw let the researcher add himself to companies and retrieve decryption keys, earning a reported $16,000.
• The agent reportedly accessed live feeds of unlisted YouTube videos before their planned announcement.
• The video attributes the approach’s scale to how many APIs and keys could be supplied to the agents.