Blending AI with Offensive Security Research and Bug Bounty. Creator of crxplorer.com
- Tweets 2,274
- Following 628
- Followers 25,417
- Likes 8,787
Pinned Tweet
Last month was my highest in bug bounty so far with almost $131k in bounty.
Total paid reports: 18
Average reward: $7.3k
Category: most were logical findings via reversing mobile applications and discovering internal endpoints leading to code execution and missing auth etc
98
123
2,809
245,605
Bug Bounty Programs need to keep in mind that they are nothing without their community of hackers.
And bug hunters, leave a comment on reports when you’re gonna stop hacking on them.
Do so assertively but not disrespectfully. Heres an example of one I recently sent.
If we never give them feedback, how can they know to do better?
4
2
54
2,942
GPT 6 SOL is wrong model to benchmark againt, compare against 5.6 SOL. I think no publicly accessible models come close to 5.6 SOL.
We found DeepSeek V4.1 Flash 1017 beats GPT 6 Sol on our multi-step offensive cybersecurity task. Sol was tested via the Daybreak trusted access program.
We have been building a cybersecurity benchmark based on simulated corporate networks. This is a valuable indicator for the cyber-risk a model poses if in the hands of a bad actor. We plan to make the full evaluation public in the coming weeks but wanted to share our first immediate finding here.
3
1
34
3,156
Yesterday, got hit with a duplicate for a critical bug: mass customer PII exposure using nothing more than a public flight number.
Worse part? The original report was submitted a month ago and the issue is still live.
6
1
103
5,195
We at @exodus BBP fully automated triage with multi agents workflows with very high accuracy, has reduced triage time 7x and needing a human to only 0.2h/week.
Though giving agents Github access was huge bump in accuracy and Platform doesn't have such luxury for their bots.
I’d be willing to pay $100 per report for priority triage with automated dupe checking and faster payouts (<48 hours). My experience with this on Immunefi was great, and it’s not a bad way to incentivize researchers to stop abusing teams as the initial assessors of AI reports.
4
1
122
7,314
Codex limits are hallucinating like their models, Earlier it dipped from 100% to 15% and now jumped back to 32%, what is going on @thsottiaux
6
32
3,985
Even with best of AI models findings like these are not going be walk in the park. you need a lot of visualisation, understanding of security model and architecture and breakdown chains in steps. Incredible talent.
‼️ BREAKING: An AI-enabled bounty hunter got $50,000 for using a 2008 Linux kernel bug to leak host memory from Vercel's production sandboxes.
In his own lab, Paulos Yibelo turned CVE-2026-99999 into a KVM escape to host root.
He used GPT-5.6 Sol, for under $700 in API tokens.
7
13
178
11,378
Fun challenge, Vercel team is cool.
We offered $1M to escape Vercel Sandbox.
• 1,285 reports
• $242,000 in bounties paid out
• One Linux kernel zero day discovered
• No reports of customer data compromise
vercel.com/blog/findings-fro…
1
2
71
5,835
At this rate, I wouldn’t be surprised if Open AI or Anthropic Acquires HackerOne, BugCrowd of similar BBP platform for all its datasets
9
3
199
10,796
Anthropic models are much better at discovery (breadth), while Open AI models are very good at exploitation (depth).
8
2
165
7,527
Anthropic's Cyber Verification is absolutely useless and doesn't align with their statements of giving capable models to defenders.
13
14
249
14,905
$460 in tokens → ~$22K in bounties.
We placed #1 on the Vercel Sandbox Program leaderboard on HackerOne with almost zero manual hacking.
When the $1M challenge dropped, we built multi-model hackbots to benchmark agent harnesses across open-weight models. We built the harness; the agents did the hunting. GLM 5.3 for exploit writing and Kimi K3 for discovery followed by DeepSeek as monitoring agent carried the most weight.
The numbers:
- Findings: 20
- Duplicates: 12
- Known risk: 3
- Paid: 5
- Top bounty: $7,500
- Max severity: Medium
Huge thanks to @Paaastha @uttam_v10 @Knaughtydog04, and to @vercel for running a smooth challenge with fair payouts.
29
27
767
25,607
Rewarded $30k one of our most impactful findings till date
0 day; UAF leading to Kernel Root RCE.
25
17
662
19,679
In Banglore this weekend, if you are doing bug bounties, building/funding AI and Security Products would love to meet.
9
122
6,069
Jenish Sojitra retweeted
Blog post about From header smuggling in Apple iCloud just dropped.
Sending emails as tim.cook@icloud.com, exotic parsing, and a $15,000 bounty.
sec-consult.com/blog/detail/…
8
98
446
42,416
