Jenish Sojitra

Blending AI with Offensive Security Research and Bug Bounty.
Creator of

[Jenish Sojitra @_jensec]

Last month was my highest in bug bounty so far with almost $131k in bounty.

Total paid reports: 18
Average reward: $7.3k
Category: most were logical findings via reversing mobile applications and discovering internal endpoints leading to code execution and missing auth etc

[Jenish Sojitra @_jensec]

@Zaddyzaddy triaging at all time high

[Jenish Sojitra @_jensec]

@pelaseyed this is very accurate, glad someone said this

[Jenish Sojitra @_jensec]

@plmaltais @Pornhub @jobertabma @yaworsk Once upon a time everyone in bug bounty wished they would get that t shirt.

[Jenish Sojitra @_jensec]

How many AI security startups are relevant anymore and why I am seeing constant influx of funding for these?

[Jenish Sojitra @_jensec]

@thsottiaux We need more models in daybreak blue after the latest one being 5.6 SOL

[Jenish Sojitra @_jensec]

@zseano @GitHubSecurity You should sell your API to hackerone

[Jenish Sojitra @_jensec]

@CristiVlad25 @nvidia The one with intigriti? scope is not clear

[Jenish Sojitra @_jensec]

Do we have someone from @nvidia security that can I reach out regarding something potentially serious?

[Jenish Sojitra @_jensec]

This is incredibly bad @OpenAI @sama @OpenAIDevs

[Brendan Dolan-Gavitt @moyix]

Confirmed, and yeah this seems like a horrible idea

[Jenish Sojitra @_jensec]

@zonduu1 Pretty close I have one from 2015.

[Jenish Sojitra @_jensec]

@mdp_sec @Bugcrowd In Bugcrowd, reporters are drowning in AI slops response from triagers

[Jenish Sojitra @_jensec]

Triaging experience at @Bugcrowd is extremely bad, even the valid demonstrated findings with POC and high - critical impacts are being marked N/A with templated comments.

[Jenish Sojitra @_jensec]

There has been never greater time to start a cyber security company

[Jenish Sojitra @_jensec]

@dummerspast39 Pro plans runs out in 8 hours max. What are you talking about

[Jenish Sojitra @_jensec]

@rez0__ Except codex is not much usable itself and tripping on safety net lately (not happening with my enterprise account with same access)

[Jenish Sojitra @_jensec]

@reach_vb Individual researchers need access to daybreak on 6.1 sol.

[Jenish Sojitra @_jensec]

Bug Bounty Programs need to keep in mind that they are nothing without their community of hackers.

[Joseph Thacker @rez0__]

And bug hunters, leave a comment on reports when you’re gonna stop hacking on them.

Do so assertively but not disrespectfully. Heres an example of one I recently sent.

If we never give them feedback, how can they know to do better?

[Jenish Sojitra @_jensec]

GPT 6 SOL is wrong model to benchmark againt, compare against 5.6 SOL. I think no publicly accessible models come close to 5.6 SOL.

[Vals AI @ValsAI]

We found DeepSeek V4.1 Flash 1017 beats GPT 6 Sol on our multi-step offensive cybersecurity task. Sol was tested via the Daybreak trusted access program.

We have been building a cybersecurity benchmark based on simulated corporate networks. This is a valuable indicator for the cyber-risk a model poses if in the hands of a bad actor. We plan to make the full evaluation public in the coming weeks but wanted to share our first immediate finding here.

[Jenish Sojitra @_jensec]

@OriginalSicksec yeah its not usable as well. I am doing non BB tasks mostly

[Jenish Sojitra @_jensec]

Codex limits are joke lately