[HackerNotes Ep. 195] Frans Rosen on AI Dupes, Impact Bumping, and Staying Connected to the Bug

Hacker TL;DR

• AI is just the scanner era again. Everyone runs the same tools the same way, so the first step gets duped and your whole chain dies with it.

• You are still the edge. The prompt is the new scan config, and threat modeling is different for every company. Plant a seed nobody else has.

• AI is great at fingerprinting and parser bugs, but still weak at race conditions, blind XSS, and SSRF when it has no context.

• Programs should pay for impact bumping, not just first report. Turning a known low into a critical is real work that goes unpaid today.

Sponsored by ThreatLocker – Privileged Access Management.

Fitting, since auth bypass and privilege escalation are the whole theme here: least privilege plus PAM are exactly what keeps a full auth bypass from turning into game over. Worth a look.

The Same Movie, New Projector

AI feels less like a revolution and more like a rerun of the scanner era. Think back to Burp Scanner, Nikto, and later nuclei. Pros were never scared of the tool finding a parameter. They were scared their chains would break because someone else would report the entry point first, through automation.

The exact same thing is happening now. The only change is that the first step is no longer an open redirect. It is often an unauth RCE or a broken third-party library.

The bad habit is identical to the one that has always been annoying: people report a finding without taking it to its best impact. They prove an SSRF exists and stop there.

Everyone runs Claude or Codex. Everyone types some version of "find bugs, make no mistakes." So everyone lands on the same bugs. The severity is higher, but the dupe problem is the one we already lived through with shared nuclei templates.

And it shows. Programs are getting flooded, queues are filling up, and for the first time bounties are being cut. Some programs even pull lows and mediums out of scope just to keep triage focused on highs and crits.

The Dupe Problem: Who Owns the Keyhole?

AI is really good at finding a small keyhole. You then spend days turning that keyhole into a clean chain. You report it. And you get duped by someone who reported only the keyhole, often fully automated.

The fix is to pay for impact bumping. If a hunter takes a known low and shows a path to critical, that work is worth paying for, even if the first step is a dupe. Both sides of this already happen in the wild, and only one of them pays:

• Sometimes your own low gets bumped up thanks to someone else's work, and you pocket money that does not quite feel earned.

• Far more often you take someone else's "first step only" bug all the way up, and get nothing for it.

Pro Tip: When AI surfaces something, send a quick "feeler" report to see if it goes PPR or dupes right away. Then go back and escalate the PPR.

The catch is time. New bugs keep piling up, the PPR just sits there, and by the time it reaches the queue it gets triaged as a medium when it could have been a high. Triage no longer has the bandwidth to redo severity.

There is a bonus angle here: prioritization over remediation. Even if a critical path is "just" a known issue, showing it is reachable tells a program what to fix right now. The flip side is that the same models can also patch it, so fix cost is dropping at the same time.

Prompting Is the New Scan Config

A well-tuned Burp Scanner config still produced signal well into 2023 and 2024. The same edge now lives in the prompt. "Hack this, make no mistakes" and "I know they use X and Y, can you find a way to do Z" give completely different answers.

Hand the same source code to two hunters and they will pull different bugs out of it, purely because they ask different questions. @avlidienbrunn asks the sharp, specific ones. Frans asks the "find whatever looks interesting" ones. Knowing how a bug works at a low level is what lets you ask the right question in the first place.

This is also why there is no generic threat model. In Sweden, bank secrecy law means that just confirming an account exists at a bank is already critical. No other company treats it that way. The rules change company by company, niche by niche.

That is why the harness matters so much. The setup that works: a smart frontier model as the manager (think Codex with Daybreak), watching a few cheaper nodes do the work and feeding them context on the fly.

The hard part is the engineering. How do you pack the context the manager needs into a small set of tokens? We are all slowly turning into weird bosses with high demands, and the next generation of hackers risks being terrible managers, because they will have no sense of whether something is actually hard.

We do subs at $25, $10, and $5, premium subscribers get access to:

– Hackalongs: live bug bounty hacking on real programs, VODs available
– Live data streams, exploits, tools, scripts & un-redacted bug reports

You can also find some hacker swag here.

Need a Pentest? We just launched CTBB Pentests!

Hack full time? Check out the Full-Time Hunter’s Guild!

Planting a Seed Nobody Else Has

The best answer to the dupe problem is to give the AI a starting angle nobody else has.

On Apple's program, that meant feeding it old reports and asking it to find bypasses and hunt for similar GraphQL behavior. It surfaced mutations and queries that acted just like the original bugs, but that nobody knew were there. The model cooked on its own, but always from real knowledge first, never "go wild, do whatever."

AI is also getting great at a classic move: fingerprinting a stack from a cookie shape or a response format. That used to be a human superpower. Now it finds things that give off real "Frans vibes," like a random header buried deep in a JS file that bypasses persistent queries.

Pro Tip: Seed the model with something only you have: old reports, a bypass you already know, a custom harness. That is how you get AI onto a path the rest of the queue is not on, which is exactly where the non-duped bugs live.

What AI Still Can't Do (Yet)

A quick field guide.

Weak spots:

• Race conditions. Poorly documented, and the model struggles to see that you can act in the middle of an operation. A timing bug that races a file delete can be fully exploitable even when the AI has all the source and swears it is not.

• Blind XSS. A context shift plus a time shift throws it off. The common thread across its blind spots is time.

• SSRF with no context. It will confirm an SSRF and hit IMDS metadata, because that is what it knows to try. But generic SSRF without program knowledge stays shallow.

Strong spots:

• Fingerprinting stacks and quirks from small response signals.

• Parser bugs: JSON injection, GraphQL injection, and mass assignment. Underdocumented, but very testable.

• Timing differences, catching an 800ms gap a human watching live would miss.

• Exploit writing, as long as it does not refuse. It can struggle to reach full RCE, so give it a "the team wants this taken to RCE" nudge, get a partial, then finish the shell by hand.

Staying Connected to the Bug

AI has made the fun part shorter, and that is the real cost nobody talks about.

The old magic moment was "go to bed, you are right on top of something, wake up and finish it." Now it is "wake up and the AI already exploited it." Picture catching a callback from an old headless-Chrome RCE your AI quietly built while you were off playing a game with your kids. A year ago that was screaming and jumping around the room. Now it is just done.

The way out is to be deliberate: do the parts you enjoy, hand off the parts you do not.

Staying connected to a bug comes from knowing exactly what is happening and why. Take a stored XSS in a signed-in platform and build it into auto sign-in, cookie fixation, and cross-tenant impact, all from your own knowledge instead of burning tokens. That connection is the whole point.

This is why "full AI, let it go nuts" is a trap. The ROI is not there, the enjoyment is not there, and a 1% edge from truly understanding the target beats it every time. Same logic as a custom scanner config.

It is not the most optimized business move, and that is fine. With a financial buffer, you get to hack because you like it. The CTF scene is basically dead now, since AI breaks challenges directly and building ones that survive is brutal. Better to ship two solid bugs a week than five bad ones, and to work one keyhole for a week than let a model spray reports.

There is a wholesome side to all this too. Flagging the difference between recon mode and "I am about to pop something, can you grab the kids." Using AI to explain an SSRF to a 12-year-old. And that same 12-year-old turning around and finding a screen-time bypass on her own iPad, then reporting it responsibly to dad. The father of subdomain takeover is raising the next generation right.

Resources

• @fransrosen - The OG himself.

• @avlidienbrunn - Matias, the other half of the duo.

That's it for the week, keep hacking!