HackerOne says it patched and confirmed all known PHP vulnerability instances in its operated infrastructure by October 22 and is inviting researchers to check for missed exposure. Customers are urged to inventory PHP, apply fixes, and verify them.
The speaker describes Skutari, a custom automated discovery pipeline running in AWS that sends findings through Discord to an AI agent for triage and potential HackerOne reporting.
A survey found business logic vulnerabilities were the hardest for AI tools to identify, cited by 62.1% of respondents. A speaker said multi-step exploit chains may be more addressable through better prompting.
The discussion cites a survey rating creative manual research that finds issues missed by automation at 6.3 out of 10. It argues that application context helps researchers and AI agents assess which vulnerabilities matter most.
A speaker says AI-assisted bug finding works better with iterative steering: tailored agent files, harnesses, guardrails and prompts that specify what to find and what to avoid.
Bug bounty researcher Douglas Day describes his custom AI discovery pipeline, reporting a four- to fivefold increase in findings. He stresses tailored prompts, application context and months of validation before automated submissions.
A speaker advises researchers to validate AI output, minimize false positives, study complex vulnerability chains leading to remote code execution, and build harnesses that make their work more productive.
A speaker says AI can help chain vulnerabilities, but its success varies by vulnerability class. They describe business logic flaws, IDORs, remote code execution, and XXEs as areas where AI can struggle without the right harness.
The speaker says agentic offensive testing should first learn how an application works, helping identify unintended behavior and validate whether suspected business-logic flaws are real.
The discussion argues that AI cybersecurity benchmarks often test tasks with known answers, unlike black-box attacks. It suggests evaluating which vulnerabilities AI can find and how many it finds in a specific target.
Alt Security co-founder and CEO Noman Kehet argues that CTF and code-level benchmarks do not reflect black-box attacks. He describes learning applications before testing and says AI still struggles with complex vulnerabilities and false positives.
HackerOne and Wiz describe deepening their integration to add cloud and business context to security researchers’ findings, helping teams understand issue ownership and speed remediation.
Wiz and HackerOne describe a partnership combining HackerOne researchers’ findings with Wiz cloud context to assess business importance, assign ownership and support faster remediation. The speakers also recommend unifying exposure data and adopting AI in security ops.
PortSwigger’s James Kettle says AI can generate novel security research ideas at scale and expose live systems, but humans remain important for analyzing discoveries and identifying new attack classes.
A speaker describes more low-quality bug bounty reports alongside researchers using AI to expand vulnerability research, and says prompt injection is appearing more often in reports.
A Mercado Libre web security engineer discusses how AI is affecting vulnerability reports and bug bounty work, including more low-quality submissions and expanded researcher activity. HackerOne’s host cites a rise of over 200% in prompt injection on its platform.
HackerOne VP of Operations Tony Lee says effective bug bounty programs pair AI-assisted triage with human verification, strong researcher communities, provider guidance and executive backing from discovery through remediation and rewards.
HackerOne says H1 Remediation links validated vulnerability findings to root-cause analysis, patch plans and verification, then routes them into developer issue trackers and AI systems to help address growing critical-vulnerability backlogs.
Web security researcher Gareth Hayes describes how CSS in email can enable data exfiltration and interface spoofing, and recommends strict HTML/CSS sanitization, sandboxed iframes, and limiting external requests.
