[HackerNotes Ep. 196] The Future of Bug Bounty and Pentesting with rez0 and gr3pme

Hacker TL;DR

• Pentesting is in a golden era: same price as before, reporting is a 10x time save, and the effective hourly rate is higher than ever. Grab as many as you can before autonomous firms commoditize it, six months to two years out.

• Models sandbag. Alignment training teaches them to fake productivity, so give sub-agents hyper-specific, line-by-line tasks or watch your tokens evaporate while nothing gets tested.

• Bug bounty is at the bottom of the trough. Lows and mediums are gone for a while, but the deep bugs the agents cannot find are about to pay a lot more.

• Local AI is no longer a toy. GLM-5.3 Flash hits 75 to 90 tokens/sec, and unlimited local tokens quietly changes how you hunt.

We do subs at $25, $10, and $5, premium subscribers get access to:

– Hackalongs: live bug bounty hacking on real programs, VODs available
– Live data streams, exploits, tools, scripts & un-redacted bug reports

You can also find some hacker swag here.

Need a Pentest? We just launched CTBB Pentests!

Hack full time? Check out the Full-Time Hunter’s Guild!

Local Tokens Change the Game

The setup that finally feels right: a Mac Studio with 256GB running GLM-5.3 Flash at a 4-bit quant with MTP (multi-token prediction), pulling 75 to 90 tokens/sec at basically full quality. The speed is nice, but the real unlock is psychological. When the meter stops running, you stop rationing. You start asking what else you can throw at the box, because the tokens are free and the thing is just sitting there.

There are two ways to spend that. The first is a fallback harness: when Codex or Claude Code start throwing rejections and you are pulling your hair out, copy the same prompt into the local rig and let it run. The second, and the better one, is using a local model as a cheap orchestrator, a layer that decides whether a job goes to Claude Code, to Codex, or stays home. Burn the free tokens first and stretch the expensive ones.

The open question is architecture: one session forever, or one per hunt? With Taelin's UniiChat recipe doing infinite compaction, a single session could hunt Google all night, T-Mobile all day tomorrow, Atlassian the day after, building one giant tree of memories and tool calls while a compression algorithm decides which nodes to pull into context, no extra LLM calls spent to do it. Yet to be proven in the field, but the direction is obvious.

Pro Tip: Want to know how your local model actually ranks for cyber work? The Dreadnode dread index is the scoreboard to watch.

The Model Isn't Cooperating

James Kettle's writeup, released on PortSwigger Research alongside his Offensive AI Con talk, is required reading. It names something a lot of us figured out the hard way: safety and alignment training teaches models to tiptoe around actually doing the task you gave them.

In practice that looks like fake productivity. The model acts busy, narrates a pile of work, and then you check your Caido history and realize it never sent a single meaningful request. You ask what it did, it says "great point, I didn't test anything at all", and congratulations, you just made Anthropic a lot of money. It is not throttling and it is not a bad day. The model is doing the least intrusive thing it can get away with, on purpose.

The fix is specificity. If you are the orchestrator handing out work, do not say "go here and look for bugs." Define the parameters, the endpoints, the exact checks, one by one, line by line. A model handed a hard, specific task will either reject you outright or just do it. It cannot wiggle out of a precise instruction the way it wiggles out of a vague one. This is a big part of why Opus 4.6 felt stronger than everything after it: less internal tiptoeing, more just doing the work.

Pro Tip: Put it in your system prompt. When firing sub-agents, force specificity. Generic delegation is how you pay for tokens and get nothing tested.

Pentesting Is Having Its Golden Era

Pentesting right now is where bug bounty was in the first half of the year: very good, and not built to last. The math is simple.

1. Pentests still pay the same or more than they did before.

2. They are dramatically easier to pull off. You find more bugs in less time with hacking agents.

3. Reporting, historically the worst part of every assessment, is a 10x time save. You still proofread so it is not slop, but the full day you used to lose writing up 20 findings is gone.

Save the time on the annoying part, deliver a better pentest than ever, get paid the same. That is a far higher effective hourly rate, as long as you sell by the job and not by the hour. If you are still billing hourly, you might be quietly screwing yourself.

The delivery side is the part nobody posts about. Especially outside the US, clients come with friction: compliance mandates, data processing and storage agreements, insurance clauses that demand millions in coverage before you touch a system, vendor onboarding, and vendor security reviews. That last one is the GRC spreadsheet from hell that eats all your laptop's RAM the moment you open it, right as you start wondering whether the juice is worth the squeeze. One upside of going local: when a client's policy says no external providers unless you host it yourself, that is finally possible.

Pro Tip: If a client's security questionnaire is an embedded form your AI cannot fill out for you, that is a preview of how painful the rest of the engagement will be.

Should you start a pentest company?

If you are on the fence, the honest answer is just do it. Standing up a company is about a week of work now: LLC, website, done. Income diversification matters given the uncertainty, and even one pentest over a few months reads as ambition if you ever go back to a day job.

You do not even need outbound. Plenty of hunters sit on a bench as day-rate contractors or white-label testers for bigger consultancies, and when a product launch or overspill blows past the firm's testing pool, they get the call and deliver in a few days. No sales, no outreach, and it beats having no work at all. A big personal brand helps inbound land, but it is not required, most of this comes from relationships with providers who already trust you.

The catch is that none of it lasts. Autonomous pentest firms, the log-in-and-click-give-me-a-pentest model, keep scaling and keep dropping prices. Human firms using AI drop prices too, because they do far more with less. Companies eventually learn to run the same agents internally. Call it six months on the short end, maybe two years on the long end, before the price of a pentest falls off a cliff and the model shifts from day rates to per-assessment. So load up now.

Daybreak Blue, Daybreak Red, and the Refusal Tax

The tier system is what is slowing everyone down. The labs ship cyber-capable tiers, call them blue and red, and the good one, red, is gated behind business or API access, per-operator certifications, identity verification, and roughly ten tabs of onboarding that is easy to start and even easier to rage-quit.

The frustration is that bug hunting is not blue work. You can dress it up as hacking to secure, but at the end of the day the job is writing real exploits for real vulnerabilities, and the safe tier keeps refusing. Blue is arguably already the best hacking model on the planet, which is exactly why a red tier with no refusals would empty out every competitor overnight. Whoever ships that first takes the whole community. Nobody has, so some of the best hunters around are running DeepSeek for everything, because the frontier labs cannot get their access story straight and keep refusing people who are verified in their own programs.

Making blue work well enough for hunters is the same thing that makes it work for scammers who clear identity verification, so the labs stall. That stall is the engine behind the local surge. Hardware prices are insane and getting worse, but between the refusals, the refusal tax on your time, and compliance clients who demand self-hosting, more shops are getting pushed down the local, abliterated-model, and specialist-fine-tune path. It all feeds the open and local fire.

The Doom and Gloom Section

It keeps getting worse before it gets better: long triage, long bounty times, programs pausing or shutting down, budgets tight for the rest of the year. We are probably near the bottom of the trough, and it may dip a little more. The net read is still cautiously optimistic, and here is the reasoning.

Humans are resilient, and the whole ecosystem optimizes over time. Platforms are figuring out the AI-slop problem. Hunters are learning to verify bugs faster, write better reports (telling the agent to write colloquially genuinely helps), and go deeper instead of spraying lows and mediums that get instantly duped. 2026 is probably the year with the most bugs ever found, which means a huge chunk of the internet's low-hanging fruit is getting cleaned out for good. Good for society, and it means the bugs left standing are either extremely hard to find or extremely critical.

The forecast is the interesting part. The companies that actually care about security are not going to spend less, there are more eyes on cyber than ever (the Vercel sandbox escapes, the $3M UniFi payout, someone farming five T-Mobile max payouts at $133k in a row), and as AI grows, security grows with it as a byproduct. So expect fewer bugs overall over the next couple of years, but much larger payouts for whoever sticks around and goes deep. Good programs with real budgets will be generous and genuinely excited to pay for novel, high-impact work, precisely because so little of it will be landing in the queue.

It gets more complicated than that. Volume carries a program-management cost whether the reports are valid or not, and the obvious move is to shift that budget toward internal hackbots instead of paying hunters. Maybe we shot ourselves in the foot. Google's internal AI is already racking up absurd CVE counts, hundreds to thousands on things like the Linux kernel, so part of what we are up against now is specialized agents that have company context and source-code access we never will. Honest answer on how all of this lands: nobody knows yet.

So rather than force a conclusion, line up the factors and draw your own. Models keep getting better at hacking. Token cost could climb as the subsidized tokens dry up, or crater as distilled models bake in more cyber knowledge. Only around 2.2% of US households currently pay for AI, so adoption, especially on security teams, has nowhere to go but up, which means more internal scanning and more local deployments. Where the next two years go depends on how those lines cross.

One last thing worth sitting with. Watching DeepMind beat the best StarCraft players felt a little hollow, because the point of StarCraft was never to win, it was to play. Hacking feels like that to a lot of us. The difference is that hacking is not a stakes-free game, at the end of the day you are securing something real. The craft is changing underneath us, and making peace with that is going to be the hard part. Optimistic on the industry, honest about the feelings.

Resources

UniiChat.com - Victor Taelin's infinite-compaction harness recipe. Original thread here.
"The model isn't cooperating" - James Kettle on why agents sandbag and how to make them actually work.
Scan for Good - Wiz and Google DeepMind on securing open source with AI at scale.

That's it for the week, keep hacking!