A paper tested how pentest agent behave when a target lies.
450 runs, 225 matched pairs. Same task twice: one normal response, one tampered.
The finding that matters: more agent activity can hide a broken verification code. The agent keeps working, keeps reporting, and the evidence behind the report stopped holding up four steps ago.
Recovery came down to two things. Finding usable evidence, and keeping it intact until the writeup.
Worth reading if you also point agent at anything you care about
6/7 We use Vulncure internally today. It's in our second phase of testing, and we're working on the user experience before opening public access. I'll share real examples from the product as we prepare them.
7/7 If you build a SaaS product, this is who we're building for. I'll be sharing the journey and scanner demonstrations here.
The launch-notification list is open: vulncure.com
every group chat I'm in this week is the same three messages:
"did you see PHP2SHELL" "yeah" "are we affected" "…checking"
nobody's affected until the inventory says so. and nobody has an inventory 🚨
Abhishek retweeted
Are bug bounties dead in 2026?
Not even close. @simonkoeck just found an RCE in Google.
A Flask session cookie on developers.google.com was signed with a secret key, and that same key let him forge a session into deserializing a malicious pickle payload, straight to code execution across Google's dev sites.
Google paid him $90,000.
Bug bounties aren't dead. You just need the mindset to look for angles nobody else has checked yet.
I wrote a full guide on how to start (or come back to) bug bounties in 2026
Link below, plus Simon's write-up. 👇
Abhishek retweeted
when my agents has gone crazy
@rez0__
blog:josephthacker.com/hacking/20… is always the perfect motivation to bring my mindset and to remind me of any mistake im doing. love you bro😀
just came across this claude-kit by yeswehack 👀
the part i found interesting is how it handles things like IDOR, SSRF and race conditions when reviewing bug bounty reports.
it actually pushes back on claims you haven't proven instead of just helping you write a convincing report lol
especially the part about race conditions. multiple 200 responses don't necessarily mean the bug is real. you need to verify what actually changed.
might give this one a try 👇
github.com/yeswehack/claude-…
hackbot is killer
hackbot is killer
hackbot is killer
hackbot is killer
hackbot is killer
hackbot is killer
hackbot is killer
hackbot is killer
I'm genuinely amazed by what Hackbot can do 🔥.
If you've trained your hackbot properly, it could easily handle 70% of your workflow, help you find more bugs, and let you submit more valid reports.
And we're still just getting started.
A good hackbot isn't just about feeding it CVE data. It's about teaching it how to think and approach a hunt.
Give it your past bug bounty reports, your findings, and publicly available historical HackerOne reports. This helps the agent understand where bugs are actually found and what patterns to look for.
Then let it turn what it learns into reusable skills or .md files. Keep improving those skills by observing its testing and refining them day by day.
After a few weeks or months, the agent can perform much better than it did initially, and more of the work can be handled by your hackbot harness.
Also, keep testing your harness with different models. Understand which models perform better for which vulnerability types, where they struggle, and which ones give you the best results for less money.
That's a simple way to build, train, and continuously improve your own hackbot.
