Everything happening right now is pretty wild. The models are so strong that we're less and less useful. Well, we still play an important role as triagers, but a lot less as researchers.
And yet the bugs keep pouring in, and not small ones, and the money is falling too. But for how long?
A lot of thoughts on this today, and a few ideas to deal with it too.
Best month ever
This August was the best month of my life in terms of income, which is kind of crazy and absurd. I'll break down my numbers in a post at the end of the year like always, but I did about 5 or 6x my usual income, and it's been since GPT 5.6 Sol landed.
I'm super happy because it really lets me put money aside and prepare for the future, but it raises a lot of questions about where bug bounty is going. We're in a bit of a strange bubble. Nobody knows when it's going to burst, but for now it just keeps growing.
Public programs are getting a crazy number of reports per day, same for the private ones. And the wildest part of this flood is that a huge number of those bugs are valid, with real impact.
We're discovering we were living in a world even more full of bugs than we thought. So on one side it's great, we're securing the internet at an insane speed. But the personal feeling is pretty different, I find.
Losing the meaning
I've talked about this before, but with all of it, even though it's great that we can make money, find a lot of bugs, secure the internet, deep down it feels weird.
The bugs aren't really ours. We're kind of just an intermediary, and I suspect that at some point most companies will do it themselves and stop or scale back bug bounty, which would make sense.
I don't think the job disappears entirely, but it's going to shift and change completely over the next few years. The giants like Google, Epic Games, Amazon will very probably keep going. The smaller programs will likely close for lack of budget.
And as a hunter, the biggest ones will stay, and I don't think they'll necessarily be the best hunters technically. Because these days, being very strong technically means a lot less than it did a year ago, and that's sad.
It loses some of its soul, the excitement of finding a bug, spending days building an impactful PoC and writing a clean report. I used to get more excited by a basic incremental IDOR with big impact than I do now by an RCE I can be jaded about. It's absurd.
I know a lot of hunters who are starting to get down about all this, and I completely get the feeling. I think to find real satisfaction again, we'll have to switch to something else. Because even if you wanted to stop using AI to find bugs entirely, it would be even worse now. With the flood of reports, and the fact that anyone can find your chain and exploit it much faster, it would only bring more frustration.
So what do we do?
The long game
I don't think there's a single miracle solution, but here's roughly how I see it. I think you have to focus on the things that really mean something to you and that are sustainable over the long term.
Take my own case: if I started bug bounty, it wasn't for the money, it was because it's super cool, rewarding, technically hard and exciting. I don't do anything if it doesn't excite me, that's just how I work. And I think it's the same for a lot of hunters.
So I'm trying to recenter and think about what could excite me again. For example, if we stay in the AI lane, understanding how the models work, how to train them, how to make them strong in a specific domain, that can be exciting and it has a future. It could be an interesting path.
Shubs wrote about this in two posts (https://shubs.io/the-down-fall-of-bug-bounties/ and https://shubs.io/frontier-class-vulnerabilities-it-gets-worse-before-it-maybe-gets-better/), and his own excitement now is securing the internet at scale by hunting giant bugs in software everyone uses.
I think we all have a way to find something that makes us want to build. It probably won't be bug bounty as we knew it, but we can shift toward something different.
On my side, entrepreneurship is a part I really love. Building projects and seeing if they work, the struggles, the wins, it's exciting. Right now I'm building a running app with someone and it's so good. And AI helps a ton to move fast and iterate.
The world doesn't change, it evolves. There are and always will be problems to solve, continuously. They'll just be different, but there will always be problems to solve. And if you solve a problem and other people have the same one, they'll pay for it.
And I think the most important thing is to look for meaning in what we do. If I no longer find meaning in bug bounty, I'll look elsewhere while I wait to see how it evolves. The upside of AI is that we can do plenty of other things while it works for us.
It's also important to focus on the things that are tangible and don't move. For me that's a lot of sport, and it's a part of my life that makes me really happy and moves me forward. As long as I keep evolving, physically and mentally, I'm happy.
So for those struggling with bug bounty right now, maybe try to recenter on other things that also mean something to you, and develop other skills and qualities that will be useful, for you or for others.
I plan to keep enjoying bug bounty, and push the frontier models while they're still cheap, before seeing how it evolves. We're living through a beautiful technological shift, might as well use it fully.
I also recommend this post by Lupin, which is really interesting on everything that's happening and how to adapt: https://x.com/0xLupin/status/2087615702710538421
On that note, have a great end of the week!
Comments