Skip to main content
CPEBuddy
[LIVE] - AI Hacking & Security Research w/ Tobias Diehl

[LIVE] - AI Hacking & Security Research w/ Tobias Diehl

Source: YouTube · Tyler Ramsbey - Hack Smarter · published Sep 17, 2026 · 1:05:05

Cybersecurity
No ratings yet Log in to rate
Transcript Available
Description

This live stream interview features security researcher Tobias Deal on his path from help desk to AI-focused bug bounty hunting—including $60K in his first year, Microsoft recognition, and live prompt injection demos against Copilot 0:51.

Key Takeaways:
• Tobias moved from support tech (witnessing phishing victims) into QA, then penetration testing—about seven years ago 3:15
• He earned ~$60K in his first bug bounty year (2025) via manual research—everyone running the same tools finds the same duplicates; creativity pays 10:03
• He hunts Microsoft's program (Power Apps, Copilot), praising its scope and collaborative triage, and was named a 2025 Microsoft Most Valuable Researcher 14:10
• Treat AI as an assistant, not a mentor—use it to enumerate attack surfaces, but fundamentals matter since AI affirms wrong assumptions 17:05
• He demoed fuzzing Copilot's guardrails (e.g., blocking "when") and using his tool "Lacusta" to hide prompt injections in Word docs, enabling data exfiltration or CSV injection leading to RCE 38:10
• Lacusta also automates device code phishing—injecting tokens into docs so attackers inherit Copilot's access and spread compromise via shared poisoned documents 51:02
• 2026 beginner advice: master basics (PortSwigger), read disclosed reports, start with VDPs, target big programs with professional triage 58:05

Tobias closes encouraging beginners not to fear AI doom posts—embrace the technology and use it to find issues that keep everyone safer 1:03:55.

Sources:

  • 3:15 Career journey from support tech to pentester
  • 10:03 First-year earnings strategy
  • 14:10 Microsoft bug bounty and MVR recognition
  • 17:05 AI as assistant, not mentor
  • 38:10 Prompt injection demo
  • 51:02 Lacusta and device code phishing
  • 58:05 Beginner strategy for 2026

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 1 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

Heat. Heat. N. [music] [music] [music] >> [music] >> That was very abrupt Ladies and gentlemen, boys and girls, welcome back to another live stream. As you may notice, this one's a little bit different. It's not just me on your screen this time. I am joined by my good friend Tobias Deal. And I I think I actually did say your last name correct there. Did I do it correct? >> Yes, sir. >> Beautiful. Awesome. >> Yes. Thank you for joining for those all of you joining in the live stream. Now, I'm using reream to do all of this. I normally use reream. I won't go into the technical details on the back end, but I don't normally use reream this way. So, there's always a chance that something bugs out or I do something wrong. So, I already see a lot of people talking in chat. Uh, let me see if I can…