@AiNomadDev @Bugcrowd No fixed timeline. Finding these bugs can take minutes to weeks, and payment can take anywhere from days to even a year, depending on the program.
New research dropped as Promised.
AI assistants are connecting to everything—your cloud, your deployments, your secrets.
The OAuth implementations behind these integrations? Many are broken.
We found one-click account takeovers in MCP servers powering ChatGPT and Claude integrations. Open Dynamic Client Registration + missing PKCE + no redirect validation = full ATO.
Full writeup with methodology and PoC:
https://t.co/D3cxarj00q
#bugbounty #appsec #oauth #AI