PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

All About Hackbots: AI Agents That Hack

josephthacker.com | blog | #ai-security | #bug-bounty | #offensive-security | #ai-agents | #llm | #vulnerability-discovery | #hackbot
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Joseph Thacker defines 'hackbots' as AI systems that find vulnerabilities in hardened apps, describes his Hero proof-of-concept, and argues hackbots could eventually outperform human bug hunters.
Published
Collected

Related coverage

blog · specterops.io
AI for Offensive Security: What Works, What Does Not, and How to Adopt It
SpecterOps maps where AI helps offensive security (recon, tooling, vuln discovery) and where it still fails, stressing that results hinge on the harness: context, tools, state, independent validation, and human judgment.
blog · projectzero.google
Project Naptime: Evaluating Offensive Security Capabilities of Large Language Models
Project Naptime evaluates the offensive security capabilities of large language models, presenting a methodology, tooling setup, and early successes finding real vulnerabilities.
vulnerability · projectdiscovery.io
Beyond the Model: Neo Hunts, Exploits, and Proves 22 Zero-Days.
LLMs find vulnerabilities fast but flood teams with unverified reports. Neo confirmed 22 CVEs across 13 open source projects at ~10-20% false positives, with working exploits and runtime evidence.
blog · yeswehack.com
How to use Codex for Bug Bounty research: explore broadly, validate rigorously
YesWeHack on using Codex for bug bounty research: in black-box labs it exploited a DOM XSS in under four minutes and won admin access via a JWT flaw, with subagents and skills aiding validation.
blog · hackenproof.com
How We Built an Autonomous AI Security Triager: From LLM to 20,000+ Real Reports
AI made bug hunters sharper, and report volume doubled. How HackenProof built an autonomous AI triager that now handles 70% of submissions.
blog · projectzero.google
From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code
How Project Zero evolved Project Naptime into Big Sleep, using large language models to find vulnerabilities in real-world software, with early results and observations.
Back