How Hackers Are Building Their Own AI Advantage with Douglas Day
Source: YouTube · HackerOne · published Oct 13, 2026 · 40:44
BLUF: Top hacker Douglas Day reports that AI has transformed bug bounty hunting from manual to automated, increasing his output by 4-5x, but success now depends on sophisticated prompting and custom tooling rather than just using off-the-shelf models 2:15.
Key Takeaways:
• AI usage has shifted the workflow from manual to automated, with Day surpassing his previous year’s earnings by mid-August due to increased volume 2:15.
• Effective AI hacking requires extensive customization; Day uses custom agent files and specific prompts to steer AI away from simple bugs toward complex vulnerabilities like SSRF and information disclosures 5:58.
• The types of bugs found have changed; AI excels at finding misconfigurations and PII leaks, while business logic issues remain difficult for AI to automate effectively 4:30.
• Building custom tooling is critical; Day developed a discovery pipeline that runs in AWS and interacts via Discord to triage and file bugs automatically after months of validation 24:20.
• Program owners must adopt AI for offensive security to avoid being "steamrolled" by hackers who use AI to find high-severity bugs at scale 38:20.
The bug bounty landscape is becoming more competitive with a higher peak for success, rewarding those who remain agile and integrate AI into their workflows effectively.
Sources:
- 2:15 Discussion on the record-breaking year and shift to automation.
- 5:58 Explanation of the need for steering and custom agent files.
- 4:30 Analysis of how bug classes have shifted with AI.
- 24:20 Details on building a custom AI discovery pipeline.
- 38:20 Advice for program owners on adopting AI defensively.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
The people that are finding AI less useful [music] are the people who are just trying to use AI out of the box um without [music] like training it, without uh giving it a good agent file, without good prompting. [music] Even though I'm using AI to find a lot of my bugs, I have to do a lot of like steering. I have to [music] change my harness and guard rails. I have to say, "This is what I want you to report. This is what I want you to look for. I [music] want you to avoid this stuff." And it takes a lot of like tweaking. like I've I've modified my agent files so many times when it [music] started like uh going down a wrong path. >> So we've got with us today Douglas Day a top hacker one hacker. Would you like to introduce yourself? >> Sure. I'm Douglas Day based out of the US West Coast. U…