‘I thought it was a complete fluke’ – Katie Paxton-Fear on her bug bounty baptism and why AI will never fully replace security researchers

Summary: Katie Paxton-Fear, a UK-based part-time bug bounty hunter, university lecturer and YouTube educator, found two vulnerabilities on the day she was first introduced to bug bounty hunting at a HackerOne mentoring event, then found two more in Vegas. She argues AI will not replace bug hunting because it requires large amounts of data from bug hunters that no one will share, and says the bigger concern is already-deployed AI systems that have not been tested on platforms like HackerOne.
What's compelling: Paxton-Fear points attackers toward AI systems already deployed and never tested on platforms like HackerOne, and she notes her own first bugs came from asking how a developer would have built the thing - a question automated pipelines still need a human to ask.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026