Douglas Day Explains How Custom AI Agents Are Changing Bug Bounty Research
· 40:46 · Watch on YouTube ↗
Summary
Bug bounty researcher Douglas Day describes his custom AI discovery pipeline, reporting a four- to fivefold increase in findings. He stresses tailored prompts, application context and months of validation before automated submissions.
Key points
- Initial findings discussed from HackerOne's upcoming Hacker Powered Security Report indicate 74% of surveyed researchers saw AI improve the quality or volume of valid findings; 37% reported at least a twofold increase.
- Day reports a four- to fivefold increase in report volume, alongside a shift from manual business logic research toward automated discovery of misconfigurations, information disclosures and PII leaks.
- Day uses custom agent skills derived from previous reports, explicit prioritization rules and detailed prompts covering API discovery and authorization testing.
- Survey respondents identified business logic, multi-step exploit chains and race conditions as areas where AI tools struggle. The speakers caution that broad classifications and reporting practices may complicate interpretation.
- Day's Skitarii pipeline performs discovery, routes findings to an AI agent for triage and can submit reports through the HackerOne API. He says he enabled automatic submission only after several months of manual validation on the particular scope.
- Day recommends that program owners use AI-assisted internal security testing to keep pace with external findings and reduce triage pressure.
Article Details
- Topics
- [02:11] AI-driven changes in bug bounty productivity and vulnerability discovery
- [05:33] Steering agents through custom instructions and vulnerability priorities
- [09:45] Human application context and detailed authorization-testing prompts
- [13:49] AI limitations in business logic research and exploit chaining
- [19:06] Prompt injection severity and the need to demonstrate impact
- [23:24] Custom AI tooling and the Skitarii discovery pipeline
- [26:34] Validating findings before enabling automated report submission
- [37:25] Internal AI-assisted testing and operational implications for program owners
People
Douglas DayBug bounty researcher who identifies himself as Archangel on bug bounty platforms; describes building Skitarii and his experience configuring and validating AI-assisted vulnerability research.LukeInterviewer who identifies his online name as Hakluke and describes running a cybersecurity consultancy; contributes observations about AI false positives, application context and vulnerability impact.