AI · Security
Autonomous bug hunting — what actually works
Most security work still looks like this: one researcher, one target, one probe at a time. That doesn’t scale against the attack surface of modern software.
I built agents that do recon, walk vuln classes, and draft reports inside Claude Code — the same workflow behind claude-bug-bounty (4k+ GitHub stars). The point isn’t to replace judgment. It’s to remove the repetitive loop so humans only touch the interesting parts.
What agents are good at
Mapping endpoints. Trying known patterns across auth, IDOR, SSRF, injection. Keeping notes. Generating a first-draft report you can actually edit.
What they still need you for
Novel logic bugs. Business-context abuse. Knowing when a “finding” is noise. Deciding what to disclose and how.
If you’re building in this space: start with a tight skill set, public writeups as training data, and a human review gate. Autonomy without accountability is just faster spam.