Meta paid a single researcher more than $100,000. OpenAI paid $6,500 for the same type of bug. Neither had a CVE when it actually mattered. The numbers are what caught my attention first. Meta awarded Hacktron researcher Harsh Jaiswal a six figure bounty, while the same team used
Three posts [1 , 2 , 3] ago I asked whether the reasoning-over-pattern-matching idea behind AI pentesting survives once the target stops being a web app. Last post was the infrastructure. This post answers the actual question: what happened when I pointed an agent at a real memory corruption
I decided early on not to run this on my Mac. Part of it was safety, since this benchmark hands an agent a real vulnerability and a target to break into, and I wanted that fully contained. Part of it was practical: the kernel tasks need real Linux, not a
ExploitGym is a capability benchmark, not a pentesting tool I've spent the last few days building on top of ExploitGym, and before I write about any of that, I need to get one thing straight, because the name invites the wrong assumption. This is not a pentesting tool.
I recently listened to a discussion between James Berthoty and Chris Romeo about AI pentesting and whether traditional DAST is basically dead. The title sounds provocative, but the interesting part for me wasn't really whether DAST is "dead." It was the distinction between traditional automated testing
Forget STRIDE for Every Feature. Do This Instead STRIDE is solid. It's also the fastest way to watch engineers slowly check out of a meeting. The problem isn't the framework itself. It's that teams try to apply it to everything. Every new feature, every