How to Hack AI Applications: Real-World Bug Bounty Insights

How to Hack AI Applications: Real-World Bug Bounty Insights

In this episode, we sit down with Joseph Thacker, a bug bounty hunter and AI security researcher, to uncover the evolving threat landscape of AI-powered applications and agents. Joseph shares battle-tested insights from real-world AI bug bounty programs, breaks down why AI AppSec is different from traditional AppSec, and reveals common vulnerabilities most companies miss, like markdown image exfiltration, XSS from LLM responses, and CSRF in chatbots.

He also discusses the rise of AI-driven pentesting agents ("hack bots"), their current limitations, and how augmented human hackers will likely outperform them, at least for now. If you're wondering whether AI can really secure or attack itself, or how AI is quietly reshaping the bug bounty and AppSec landscape, this episode is a must-listen.


Questions asked:

(00:00) Introduction

(02:14) A bit about Joseph

(03:57) What is AI AppSec?

(05:11) Components of AI AppSec

(08:20) Bug Bounty for AI Systems

(10:48) Common AI security issues

(15:09) How will AI change pentesting?

(20:23) How is the attacker landscape changing?

(22:33) Where would autimation add the most value?

(27:03) Is code being deployed less securely?

(32:56) AI Red Teaming

(39:21) MCP Security

(42:13) Evolution of pentest with AI


Resources shared during the interview:

- How to Hack AI Agents and Applications

- Critical Thinking Bug Bounty Podcast

- The Rise of AI Hackbots

- Shift - Caido Plugin

- Shadow Repeater

- Nuclei

- Haize Labs

- White Circle AI

- Prompt Injection Primer for Engineers

Det här avsnittet är hämtat från ett öppet RSS-flöde och publiceras inte av Podme. Det kan innehålla reklam.

Avsnitt(61)

Black Hat 2026: Why Threat Researchers Are Hoarding Zero-Days

Black Hat 2026: Why Threat Researchers Are Hoarding Zero-Days

Is the AI "vulnpocalypse" already here? According to Casey Ellis, Founder of Bugcrowd and pioneer of Disclose.io, we aren't quite in an apocalypse yet, we're actually in a "slopdemic." The cost of dis...

15 Sep 48min

Why Prompt Filters Fail & How to Explain AI Risk to the Board | Cezary Piekarski, Standard Chartered.

Why Prompt Filters Fail & How to Explain AI Risk to the Board | Cezary Piekarski, Standard Chartered.

Is the cybersecurity industry repeating the same mistakes with prompt injection that it made with buffer overflows decades ago? As attackers iterate through 50 to 60 prompt filter bypasses daily, atte...

2 Sep 37min

Why 95% of AI Projects Fail: Model Risk & AI Governance | Sandip Wadje, BNP Paribas

Why 95% of AI Projects Fail: Model Risk & AI Governance | Sandip Wadje, BNP Paribas

Why do 95% of enterprise AI implementations fail? According to Sandip Wadje, Managing Director at BNP Paribas, many organizations attempt complex reasoning tasks on day one rather than building a matu...

27 Aug 45min

Why I Dont Trust Your AI Agent | Kane Narraway, Canva

Why I Dont Trust Your AI Agent | Kane Narraway, Canva

With over 200 AI security vendors in the market, how does an enterprise CISO decide whether to build a custom solution, buy an off-the-shelf product, or just wait out the hype?In this episode of the A...

20 Aug 52min

Baiting the Bot: How to Use Deception to Stop Autonomous AI Agents

Baiting the Bot: How to Use Deception to Stop Autonomous AI Agents

When AI agents start swarming your enterprise, they won't care about stealth. They will land a beachhead and instantly spawn 500 agents to crawl, probe, and exfiltrate data at machine speed. Is your d...

23 Juli 51min

Why AI Agents Are Forcing a Redesign of Application Security?

Why AI Agents Are Forcing a Redesign of Application Security?

When the CEO of Anthropic declares that human coding will disappear within six months, followed quickly by the death of software engineering itself, what does that mean for the future of cybersecurity...

26 Juni 51min

Why Asset Intelligence is Replacing the CMDB & Static Dashboards

Why Asset Intelligence is Replacing the CMDB & Static Dashboards

Why do CISOs still struggle with asset intelligence in 2026? Despite decades of security tooling, most organizations still have a massive 40% "dark matter" blind spot in their environment and the expl...

11 Juni 42min

The AI AuthZ Problem: Why Human Least Privilege Fails for Autonomous Agents

The AI AuthZ Problem: Why Human Least Privilege Fails for Autonomous Agents

Why are security leaders terrified of connecting AI agents to production data? Because unlike humans, AI agents don't apply judgment, and they operate at machine speed, meaning they can relentlessly h...

4 Juni 47min

Populärt inom Teknik

uppgang-och-fall
natets-morka-sida
elbilsveckan
bilar-med-sladd
skogsforum-podcast
rss-en-ai-till-kaffet
rss-elektrikerpodden
rss-laddstationen-med-elbilen-i-sverige
market-makers
rss-technokratin
rss-veckans-ai
rss-sakerhetspodcasten
developers-mer-an-bara-kod
rss-ai-med-jonas-benjamin
bli-saker-podden
rss-uppgang-och-fall
rss-fabriken-2
rss-powerboat-sverige-podcast
rss-en-liten-podd-om-it
rss-snacka-om-ai