I partially disagree with the author here. I've been active in the bug bounty community for 8 years and spend time with the top hackers. I have also found a substantial amount of bugs over the years.
Agentic bug bounty hunting just isn't that good yet. At most, it can find low-hanging fruit. The more critical bugs that are hard-to-find still can't be found by agents. Now, source code scanning is the exception, which is about 10% or less of bug bounty programs.
I feel like the people spending thousands on tokens are basically gambling. Even if you find a critical and have all the evidence, 50%+ of the time, the company will find a way to not pay you. It's not worth the token investment.
Bug bounty has actually gotten easier for me. Too many people think they can just use Agents to do all the work, and are not focusing on other more serious bugs. Over time, new comers will completely rely on AI and it will make the people with actual skills even more valuable.
The platforms are receiving more reports that use AI...and 90% are crap. It's only forced companies like HackerOne to create two report queues where established players gets humans to review their reports and everyone else goes through an AI review.
I'm a security consultant and regularly lead pentesting engagements for companies. One thing preventing most companies from using AI is the token cost. Most companies that I deal with rarely want to spent any extra money on security.
The other is the fact that no matter how many guardrails you have in place, there's always a chance (now, a high one) that production data will be destroyed or it will add more liability to the company in terms of data leakage. I can't tell you how many times I've been contacted by a client when a tester bumps into something that caused a huge issue in production or even staging environments.
I think AI works better with finding bugs in source code, before it's pushed to production, which will lead to less bugs overall.
I'm not against AI and use multiple models daily and it definitely augments my skills, but I just think we need to be more realistic about it.
Agentic bug bounty hunting just isn't that good yet. At most, it can find low-hanging fruit. The more critical bugs that are hard-to-find still can't be found by agents. Now, source code scanning is the exception, which is about 10% or less of bug bounty programs.
I feel like the people spending thousands on tokens are basically gambling. Even if you find a critical and have all the evidence, 50%+ of the time, the company will find a way to not pay you. It's not worth the token investment.
Bug bounty has actually gotten easier for me. Too many people think they can just use Agents to do all the work, and are not focusing on other more serious bugs. Over time, new comers will completely rely on AI and it will make the people with actual skills even more valuable.
The platforms are receiving more reports that use AI...and 90% are crap. It's only forced companies like HackerOne to create two report queues where established players gets humans to review their reports and everyone else goes through an AI review.
I'm a security consultant and regularly lead pentesting engagements for companies. One thing preventing most companies from using AI is the token cost. Most companies that I deal with rarely want to spent any extra money on security.
The other is the fact that no matter how many guardrails you have in place, there's always a chance (now, a high one) that production data will be destroyed or it will add more liability to the company in terms of data leakage. I can't tell you how many times I've been contacted by a client when a tester bumps into something that caused a huge issue in production or even staging environments.
I think AI works better with finding bugs in source code, before it's pushed to production, which will lead to less bugs overall.
I'm not against AI and use multiple models daily and it definitely augments my skills, but I just think we need to be more realistic about it.