Haxatron

Independent Security Researcher | LSR @spearbit | LSW @sherlockdefi | @immunefi Elite All-Star

[Haxatron @Haxatron1]

@0xcuriousapple Everything is going to be commoditised in the coming AI age.

[Haxatron @Haxatron1]

Typically when you use coding agents like Claude or Codex you manually prompt and guide the agent to the goal, repeatedly (unless the task can be one-shotted). Loops are essentially workflows designed to take the human out of the loop and guide the agent to the goal autonomously without repeated manual prompting. The most primitive loop is the Ralph loop https://t.co/tSK8xoLk4u or /goal.

[Haxatron @Haxatron1]

@pkqs91 Instead of human prompting agents to do a task, its agents prompting agents in a loop.

[Haxatron @Haxatron1]

@WhiteHatMage The hard part is finding a bounty program that pays well for chain halts in this market.

[CrypticDefense @crypticdefense]

It looks like the new meta for Security Researchers is to also excel at Agentic AI research, you must do both in parallel to stay relevant. In fact, this applies to most, if not all, white collar jobs currently.

The field is rapidly merging with AI. It’s not as simple as only using codex or claude, you have to find ways to create tools (or use existing ones) that tailor AI to a specific codebase with specialized harnesses, scans, fuzz suites, etc.

If you don’t do this, someone with little knowledge of web3 security but high knowledge of utilizing agentic AI will outcompete you. But you need both to succeed because AI isn’t enough, and it never will be.

And more importantly, if we don’t adapt to this, just remember that black hats have already adapted.

[Haxatron @Haxatron1]

@ua1552 Dlt

[Haxatron @Haxatron1]

27k for the bug-finding agent https://t.co/2IleKUaeUW

[Haxatron @Haxatron1]

@0xOwenThurm What is true though is with the right workflows, AI can turn some researchers to 10x - 100x researchers.

[Haxatron @Haxatron1]

@banditx0x The large labs will replace all of us eventually. But for now, we are here to make as much bank to retire ASAP before that happens

[Haxatron @Haxatron1]

Agentic harness development has to be the most important skill in the 21st century

[Haxatron @Haxatron1]

@suppvalen @Zcash Yes.

[Haxatron @Haxatron1]

My autonomous AI agent found 1 High and 1 Medium severity finding that could lead to remote crash of Zebra nodes in @zcash. Fixed in 4.5.0 upgrade.

No code was manually read during the discovery process. Code was manually read to validate and verify the finding and report are correct.
https://t.co/7TmhBHK45t
https://t.co/GtUp1WTBwT

[Haxatron @Haxatron1]

@0x15_eth @Zcash Thanks, you too mate!

[Haxatron @Haxatron1]

@kuprumxyz Will the judging cost exceed the judging pay?

[Dacian @DevDacian]

Future of web3sec: Arms Race - Defensive AIs vs Offensive AIs, with teams of elite humans continually improving them.

Protocols that aren't monthly scanning their existing code using continually improving Defensive AIs will fall behind the curve & more likely to be exploited.

[Haxatron @Haxatron1]

Thank you for the comment. I will make sure there is no room for misinterpretation next time. And I think everyone agrees that LLM psychosis has become a huge problem in the industry. But also the barrier to finding valid bugs in bug bounties has never been lower. In the end, it all comes down to being responsible with the usage of AI as a tool.

[Haxatron @Haxatron1]

How bad is the backlog for bug bounty programs now?

[Haxatron @Haxatron1]

@Bharg4v @hrkrshnn GPT less. Claude is just really bad (in my opinion)

[Haxatron @Haxatron1]

To be crystal clear here: I do not condone flooding programs with AI slop which ruins bug bounty experience for everyone. Here, observing their response to the finding means finding out whether the project ghosts you or underpays you terms and you can calibrate whether you should spend more time / tokens on the project

[Haxatron @Haxatron1]

A good thing about fully autonomous AI audit agents is you can generate submissions (validate them first!) send them to the bug bounties and observe their response to the finding to determine whether you wanna spend more tokens there lol

[Haxatron @Haxatron1]

@adrianhetman => But using BBP as final check for your AI? Not cool bro 😅

Also, nowhere in the original post or my reply to this did I mention this. And I in fact stated in my original post to validate submissions first. So I am not sure how you got to this conclusion.

[Haxatron @Haxatron1]

@adrianhetman => With AI agents researchers only need to send clear cut validated high/critical findings from their agents and observe response, instead of spending weeks digging into the code and getting rugged in the end.