The further we go, the easier it gets to find vulnerabilities with the new AI models. It's exciting and terrifying at the same time, and as a solo hunter you have to keep up. So I want to tell you a bit about what a week looks like for me right now.
I also finally got my Busy Bar and I'm really happy with it, so I'll show you how I use it day to day.
Fast Pace
For months now we've been in a constant stream of new stuff in our field. Every day or every week there's a new tool or model to test.
It has calmed down a bit and things are moving a little slower now, but it's still way faster than before. You constantly need the latest tool and the latest model to stay on the edge and be the best.
And it's frustrating when you can't keep up or match that level. Even though honestly it was always like this, even without AI. The difference is that before, you had to stay sharp on your skills and follow the news and the new techniques. Now you just curl a new version of your tool.
What's funny is that we still have the same problems, they're just presented differently. It's been like that since the dawn of time.
In moments like these I like to slow down and get back to basics. That's why with my simple setup I get much better results than before, when I wanted the perfect orchestrator, the perfect setup. Now I'm just really happy with my little tmux and my little server running 4 Codex sessions in parallel that I babysit myself.
It's still a certain rhythm though, because you have to constantly check, monitor, watch your token usage. So it's mentally demanding, but a lot less exciting and technically interesting, sadly.
It's wild, because before, the stress was not finding bugs. Now we find so many that the stress is not having the time to report them all fast and the right way. Because it takes a fair bit of time to verify everything properly, especially when Claude or Codex hands you an unreadable vulnerability with a PoC in 18 steps, 4 bash files, 2 python scripts and a VM to set up.
And that's where experience helps a ton to simplify all of that. Knowing where to put the focus in the report, the explanation, and the simplest way for a triager to reproduce the PoC and understand the impact. Making a clean video that really shows how impactful it is, and why.
All that just to get duplicated.
Dupe land
Another thing that in the end hasn't changed much compared to before: the dupe rate has gone up a lot. But before, we used to get duplicated on a simple IDOR, or a vuln you find just browsing the site, or something a scanner picked up.
Now we get duplicates on multi-step chains that end in a beautiful RCE, the kind of bug that would have been our bug of the year before. Now it's a classic Tuesday night.
I've never reported as many Highs and Criticals as I do right now, and a lot of them. It's exciting but frustrating, because in the end you watch a really slick bug go by, you verify it, you triage it, you report it, a little smile and off to the next one.
I got duplicated by 24 hours on a gorgeous bug, a critical worth 20k. But that's the game right now and you have to play by the rules.
What's even funnier is that the solutions and the advice are still the same as two years ago. Knowing how to focus on a specific niche of the app, picking a program you like that responds the right way, and focusing on it.
Being too classic and doing what everyone else does, meaning asking Claude or Codex to find a vuln (even though I still do it quite a bit and it works), only increases the risk of a dupe.
On the other hand, focusing on one technical part of an app and letting the agent dig into it deeply has a lot more upside.
All this to say that in the end we have the same problems as always, the execution is just much easier than before and much less technical. We'll see how it evolves over time.
Busy Bar
I finally got my new little gadget, way too expensive for what it is: https://busy.app/
But I'm super happy with it. Especially the pomodoro part, which is really nice and blocks my notifications and apps. Yeah, I could easily have done that another way, but I like the visual and everything else it brings me.
And thanks to the agents too, because I was able to completely rewrite the device's firmware and implement exactly what I need.
I added a way to notify me when a session needs me or has finished, so I can do something else, be somewhere else, and still get a visual notification when I need to act on a session.
I also put my Claude and Codex usage on it, plus my server stats to check I'm not pushing the CPU or RAM too hard, so I can monitor everything.
It's a really nice gadget and I'm happy with it for now.
Comments