hakluke / Are bug bounties cooked?

← back to blog

This blog was written by hand without any AI assistance. Does that make the blog more valuable? I'm not sure. And that's kind of what this blog is about.<br>I'm in Kuala Lumpur at the moment. It's insanely humid here so air conditioned shopping malls are like magnets, and I'm like ironman. Luckily there are loads of malls here. The bigger ones are crammed with luxury brands. I caught myself ogling at some nice watches through a shop window, the sales person noticed and commented on my trusty Casio. "Time for an upgrade?"<br>Then he started talking my ear off about the history of mechanical watch mechanisms vs. quartz. My ears pricked up - he was describing exactly what's happening in the bug bounty space right now.<br>For about 400 years, a handful of craftsmen in Switzerland dominated the watch-making game. Back then, it was really difficult and expensive to make a watch that kept time accurately. They used a complex arrangement of gears, weights and springs, assembled by hand. Then, around the 1960's, the "Quartz Revolution" (also known as the "Quartz Crisis", if you were a watchmaker) took place. Someone figured out that a quartz crystal vibrates at a precise frequency when you run electricity through it. This precise frequency could be used to keep time with far more accuracy and almost no moving parts. Importantly, it could also be mass produced at a fraction of the cost of a handmade Swiss watch mechanism.<br>The Swiss actually invented this method, and even made the first quartz watch prototype, but they didn't think it would ever take off, so they shelved it. Seiko Japan got wind of this and shipped the first commercial quartz watch in 1969, called the "Astron". Almost overnight, a whole bunch of generational Swiss watch makers went out of business, and artisan watch-making became virtually extinct.<br>Except Swatch. They went head-to-head with Seiko by releasing a small, fun, plastic quartz watch and it did very well. They realised that quartz watches were the new norm, and they adapted to the times by producing them instead of mechanical watches.<br>Today, mechanical watches are not sold for their accuracy, but they are still sought after for their artistry, heritage and meaning. In some circumstances, they are also still preferred for practical reasons; they don't need batteries and they tend to last longer, often passed down through generations.<br>So to put it all together: A complex art form (watchmaking/hacking) was automated cheaply (quartz/AI). A bunch of artists (watchmakers/hackers) were suddenly out of a job, but the ones who adapted (Swatch/AI innovators) excelled. The art of watchmaking (or manual hacking) is still prized for niche purposes, but the primary purpose of the art form (keeping time accurately / finding bugs) was replaced by a better technology (quartz/AI).<br>I'm one of the watchmakers. There's a part of me who misses how hacking used to be, before AI. Don't get me wrong, I love AI. It makes me more productive, and I use it extensively every day, for hacking and for everything else, but I can't help feeling like a beautiful art just got automated.<br>It doesn't really matter how I feel though - AI is here to stay.<br>Bugs: Supply vs. Demand<br>Five years ago, a critical bug was genuinely hard to find. It took years of intuition-development, a deep mental model of a target, and a few tricks you'd developed yourself. The number of people who could reliably find a critical bug in a hardened bug bounty target was small, and that scarcity was the product. Programs paid well because they were renting a rare kind of hacker brain.<br>Now, many of those same bugs are findable by almost anyone with basic hacking knowledge and a frontier model subscription. Bug discovery suddenly got cheaper, faster, and easier, and the moment something gets cheaper, faster, and easier, supply goes up.<br>Demand, meanwhile, hasn't changed. Companies need the same number of bugs fixed as before. Supply increases, demand stays the same, the value of a bug plummets. That's not the whole story though.<br>AI Can Replace Most of What Hackers Did<br>From my own bug bounty hunting, conversations with top hunters, and just keeping up with the field, I can tell you that a huge chunk of bug bounty submissions now are bugs that were found by AI automation, either partly or completely. And as models get more intelligent, the need for clever harnessing is diminishing. A year or 2 ago my AI bug-finding setup involved a complex harness to keep things on track. Now I'm finding that the frontier models without any harnessing are more effective because they have the freedom to "follow their nose" intelligently, the way a human hacker would. The frontier models have gotten so good that you can roughly point one at a program, say "find bugs in this," and it will. They still require validation though, and they perform better with some guidance from someone who knows what they're doing.<br>We've seen a similar...