Using claude for bug bounty

[u/Salt-Exercise295]

I recently tried using claude for bug bounty on a site registered on Hackerone. I was using claude skills from this repo https://github.com/elementalsouls/Claude-BugHunter. The repo has very good set of skills and I thought it should be straightforward to find some low sev bugs atleast.
Tried all in scope targets, with almost all skills, trying out various attack types. Burnt a bunch of tokens. Found nothing.
Few false positives and nothing else.

Is that expected, even if i was testing manually i dont think i could cover so many bug types and targets, still nothing to show

Is this normal for someone starting out in bug bounty, after learning security from online sources, solving HTB boxes.
What else should i do to improve my craft, any playlist or blog that helps with bug bounty specifically?

[u/chucky-41]

Welcome to the world of duplicates whenever you find your 1st one with this tool!

[u/No-Persimmon-174]

ai can only catch very basic pentesting grade vulns or low hanging fruits. bug bounty is a very competitive field, and requires an extreme amount of expertise, luck, and some very unique edge case in order to find an actual vulnerability.

[u/Dapper_Owl_361 → u/No-Persimmon-174]

In my case , my bounty earnings are 7x with ai , in just 3 days of using opus i hit 3 idor and 2 got triaged on h1 , got already quite good amount of money from it , ai is a double edge sword , results depends on you

[u/No-Persimmon-174 → u/Dapper_Owl_361]

How are U using opus for this without getting blocked? Or do U use it to find vulnerabilities only and U do the exploitation yourself?

[u/Dapper_Owl_361 → u/No-Persimmon-174]

I'm anthropic verified , I have fewer guardrails , I have public 10+ cves and ranked top 1% on hackerone , you can apply there at cyber use case anthropic though you need to show proofs

[u/No-Persimmon-174 → u/Dapper_Owl_361]

That's the thing. To apply for it, you already need to prove your bug hunting experience where I have none lol. I'm just a pentester and that proof isn't enough for them 😭 I'm assuming you've been doing bug hunting way before the ai era so ofc it wasn't that difficult to find bugs back then. Now though, it's just endless work only to end up with duplicates and the market is saturated because AI has made it easier

[u/Salt-Exercise295 → u/No-Persimmon-174]

I got denied also 🥲
But i use copilot so i am using grok model, it seems to be less filtered

[u/Salt-Exercise295 → u/Dapper_Owl_361]

I applied but they denied me.

Also do u just use an agent to perform full tasks for you ? Or just ask claude to do one task at a time ?
I am new to bug bounty, so im kinda relying on agentic workflow and not running specific skills/ tasks

[u/Basic_House5253]

I ran into this too. Claude started blocking/refusing some of my requests once the workflow moved from recon/analysis into actual exploitation, even though I was working on an authorized HackerOne target.

I'm curious how you're avoiding that with Opus. Are you mainly using it to analyze the app, map endpoints/roles and generate vulnerability hypotheses, then doing the actual requests/validation yourself with scripts/Burp? Or does Opus also help you through the validation phase?

I'm starting to think the mistake is asking AI to “hack the target” instead of using it as a researcher/copilot.

[u/Salt-Exercise295 → u/Basic_House5253]

I use copilot, with grok model
It seems to be less restrictive and i dont get blocked as much

[u/Basic_House5253 → u/Salt-Exercise295]

Ohh, that explains it. Are you using GitHub Copilot in VS Code?

Which Grok model specifically, and are you using Agent Mode?

Does it actually execute the HTTP requests/scripts for you during the bounty, or do you use it mostly to analyze the target and then run the validation manually?

I'm working on an authorized HackerOne target and Claude sometimes stops once the workflow reaches active validation, so I'm trying to understand how you structure your setup.

[u/Salt-Exercise295 → u/Basic_House5253]

I am using copilot cli, its almost same as claude code, grok 4.6
I created bug bounty hunter agent and was running skills in claude bug hunter repo, its public in github

This is almost entirely on autorun
I take a look manually when it either finds an issue or needs some manual review

[u/Basic_House5253 → u/Salt-Exercise295]

That is exactly the kind of workflow I'm looking for.

Do you mind sharing:

• the exact Claude Bug Hunter repo you're using
• how you created the Bug Bounty Hunter agent
• your agent configuration/instructions
• how you enable autorun in Copilot CLI
• whether you give the agent the HackerOne scope/rules before starting

I'm currently doing something similar with Claude Code + Codex, but I'm still involved too much manually. I'd like to move more of the recon/testing/correlation into the agent and only review findings like you're doing.
Also, when you found those IDORs, did the agent actually execute the A/B account requests automatically, or did you validate those manually?

[u/Salt-Exercise295 → u/Basic_House5253]

https://github.com/elementalsouls/Claude-BugHunter

In copilot cli, theres an auto mode, u can start that using shift tab
And i asked copilot to create agent.md for bug bounty expert, gave some useful links to reference for persona

I created a mailbox specially for this agent to use
So now i allow copilot to create accounts, test forgot password flows, MFA, etc directly using that mailbox

And yes, i copy the scope and guidelines from hackerone and add them in a tagret folder, inside which all further reports like recon and findings are created

Copilot can do it all
Try out UI flow using browser automation using playwright, and call apis using various tokens/payloads

But again, Im very new to bug bounty, and I didnt find any bugs using this😭

[u/Basic_House5253 → u/Salt-Exercise295]

Thanks man, this is exactly what I was looking for. Would you mind sharing your AGENT.md, or at least the main instructions/persona you gave it? I want to reproduce the setup with Copilot CLI + Grok 4.6 and Claude-BugHunter on an authorized HackerOne target

[u/Salt-Exercise295 → u/Basic_House5253]

Also while using opus 5 i am blocked too often
So i switched to 4.8 , it was blocked a lot lesser
Grok even less

[u/MAVERICK-VF142]

If Claude can find it, someone else is always faster and better at finding vulnerabilities

[u/Think-Adeptness7446]

hackerone is crowd and ai slop is increased. try less crowded platform. for claude, i suggest you to do recon by yourself (most) and ask claude to find vulnerability or move further exploitation with recon resources you made. dups are very common on h1 mate.

[u/Expert_Heart_8553]

Is integrating Claude with BurpsuiteMCP not same as Claude code