huntr

Great news, huntrs... 🐰 We're excited to introduce Gradual, our new community space made just for YOU! Connect with other huntrs, check out our latest blog posts, watch must-see videos, and join virtual events that'll level up your AI/ML bug bounty hunting skills. If you have a huntr account, you’re already set up with SSO. Have questions? Just PM our team – we're here to help. Ready to level up? Sign up at https://bit.ly/3VSoNrX #huntr #bugbounty #aisecurity #gradual

Protect AI's October Vulnerability Report is live, and this month we’re dropping 34 fresh vulns discovered by our badass huntrs. 🔥 Highlights? Timing attacks in LocalAI and some IDORs in Lunary. These aren’t your average bugs this month, that's for sure. Ready to dig in and learn from the best? 👉 https://hubs.ly/Q02W9SRr0

Honest question for the hackers and threat researchers out there: How do 0-day vulnerabilities change when we’re talking AI? Spoiler: they get a lot more unpredictable. These aren’t your run-of-the-mill bugs—AI 0-days expose entire systems, not just code. 😬 Dan McInerney, your favorite threat researcher from Protect AI, breaks down why AI/ML vulns are a whole new animal, diving into threats like training data leaks and beyond. Hackers, you’re gonna want to take a look at this one 👉 https://hubs.ly/Q02Vy0j-0 #aizeroday #huntr #aisecurity

Two more tools that 𝐮𝐬𝐞 𝐋𝐋𝐌𝐬 𝐭𝐨 𝐟𝐢𝐧𝐝 𝐯𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐢𝐥𝐢𝐭𝐢𝐞𝐬 𝐢𝐧 𝐬𝐨𝐮𝐫𝐜𝐞 𝐜𝐨𝐝𝐞: Autokaker (C) and Vulnhuntr (Python). Here's how they work: 1️⃣ Autokaker by Alfredo Adrian Ortega Detects buffer overflows, integer overflows, and format string vulnerabilities in C code and attempts to patch them. 🛠️ Repo: https://lnkd.in/gPRFt9B8 The repo contains slides and a whitepaper for Alfredo’s Off-by-One 2024 presentation on “AI-Powered Bug Hunting Evolution and benchmarking". This VS Code extension performs the same analysis in your IDE: https://lnkd.in/g36BvmCV Alredo also released crashbench, a benchmark to measure bug finding and reporting capabilities of LLMs: https://lnkd.in/gGvmDbZy 2️⃣ Vulnhuntr by Dan McInerney & Marcello S. Vulnhuntr uses a combination of LLMs and static analysis. It works by: 1. Doing an initial pass to identify entrypoints (e.g. routes) and potentially interesting code to analyze. 2. Then it has a series of vulnerability class-specific prompts (local file include, RCE, XSS, SQLi, SSRF, …). 3. It uses Jedi to resolve symbols (e.g. a Python-specific library for “show me the implementation of this function or class”). 4. And finally concatenates the target code + context from Jedi + vulnerability-specific prompt → potential issues. 🛠️ Repo: https://lnkd.in/gNZCb2rc Let me know if there are other AI-based code analysis tools I should be aware of! #cybersecurity #ai

What if AI could find the critical vulnerabilities you’ve been missing? 👇 Enter Vulnhuntr—the LLM-powered tool already exposing 0-day exploits in high-profile AI projects. We’re talking RCEs, XSS, SSRFs, and more—uncovered faster than you can refresh your repo. For our hacker community, Vulnhuntr is the edge you’ve been waiting for. It dissects complex, multi-file vulnerabilities and gives you a clear path to critical exploits. No fluff, no false positives—just the real risks you need to exploit. Time to secure AI, get paid, and show what you’re really capable of. 🔗 Check it out: https://hubs.ly/Q02V5-kq0 #vulnhuntr #bugbounty #LLM #aithreatresearch #zeroday

New to huntr and wondering how things work around here? 🏹 We've laid out a roadmap just for you, detailing exactly how to submit your first vulnerability. Or maybe you're a seasoned pro in traditional software or ML security looking to dip your toes into AI/ML bug bounty hunting for some extra cash $$. We've got a beginner’s guide that breaks it all down for you: https://hubs.ly/Q02TQ-z50 I know, pretty efficient right? #bugbounty #bugbountyhunting #aisecurity

ATL hackers, you in? 🔥 Huntr’s rolling up to the #MLSecOps meetup in Atlanta next month, and we want to see you there. We’re bringing our top threat researchers to drop some AI/ML bug bounty tips, but let’s be real—it’s all about hanging out, swapping stories, and maybe throwing some swag your way. Come for the intel, stay for the fun—yeah? See you there: 🔗 https://lnkd.in/gcN4CAW8 #aisecurity #meetup #freeevent #hackers #bugbounty

The real AI threat? It’s not some doomsday sci-fi stuff—it’s the vulnerabilities in your AI tools waiting to be exploited. Hackers are already exposing these flaws, and it’s happening now. Dan McInerney said it best: “They want to just point and click: I own your server and I own all your data.” Here's the full breakdown: https://hubs.ly/Q02Tsfs20 #aisecurity #bugbounty #huntr

Have you checked this out yet? 👇 Our huntr, Nhiên Phạm (aka nhienit), uncovered CVE-2024-5443 in a large language model server by bypassing a path traversal filter, leading to malicious code execution through the ExtensionBuilder function. Catch all the details of his discovery here: https://hubs.ly/Q02SZMKN0 And for you huntrs looking to get your work in the spotlight, drop us a PM! 💬 #huntr #bugbounty #remotecodeexecution

How often do you think prompt injection goes unnoticed in LLMs? 🧠 In this MLSecOps Community podcast, Sander Schulhoff explains prompt engineering techniques like chain-of-thought reasoning and self-criticism, and how they can shape LLM behavior. While these methods help improve AI performance, they also leave room for vulnerabilities like prompt injection to sneak in. If you’re hunting AI bugs, this is something you need to keep an eye on. Check it out and let us know your take 👉 https://bit.ly/3Y15Kwq #prompthacking #aisecurity #huntr