Bug Bounty Village

Bug Bounty Village·25 min

• DEF CON
• AI Security
• Date: Aug 2026
• Location: Las Vegas

Pedro Paniago

Walks through a bug bounty hunter's experiment wiring AI into his manual methodology, with the results, limits and practical tips it produced.

Bug Bounty Village·27 min

• DEF CON
• AI Security
• Date: Aug 2026
• Location: Las Vegas

Bogdan Steele · Arnav Garg

Presents MPG, a framework that mutates confirmed indirect prompt injection payloads to measure how many variants still bypass an AI assistant's safeguards.

Bug Bounty Village·24 min

• DEF CON
• AppSec
• Date: Aug 2026
• Location: Las Vegas

Alex Brumen

Explains how attacker-influenced cache key components cause collisions that poison responses in Nginx-based caching setups.

Bug Bounty Village·24 min

• DEF CON
• AppSec
• Date: Aug 2026
• Location: Las Vegas

Shrimant More · Martzen Haagsma

Shows how HackerOne runs its own bug bounty program on its own platform, and what three disclosed reports revealed about the product.

Bug Bounty Village·21 min

• DEF CON
• AppSec
• Date: Aug 2026
• Location: Las Vegas

Glendon Chong

Walks through three TikTok bug bounty reports where web cache poisoning on an OAuth login endpoint led to account takeovers.

Bug Bounty Village·18 min

• DEF CON
• AppSec
• Date: Aug 2026
• Location: Las Vegas

S Simsek · A Aydogan

Shows how ECDSA signature malleability lets an attacker flip the recovery byte v to create a second valid signature, enabling replay, and how to scan live Ethereum transactions for it.

Bug Bounty Village·23 min

• DEF CON
• AI Security
• Date: Aug 2026
• Location: Las Vegas

Amaan Pathan

Shows a multi-agent bug hunting workflow that maps an application, routes candidate findings to specialized agents, and reports only issues it can reproduce.

Bug Bounty Village·27 min

• DEF CON
• AI Security
• Date: Aug 2026
• Location: Las Vegas

Joey Melo · Edward Morris

Shows how two researchers earned bounty and competition payouts by attacking AI chatbots and coding agents, from token-based jailbreak contests to a prompt-injection chain that led to code execution.

Bug Bounty Village·28 min

• DEF CON
• AI Security
• Date: Aug 2026
• Location: Las Vegas

Katie Paxton-Fear · Max vonBlankenburg

Shows how turning bug bounty reports into Semgrep rules can separate real vulnerabilities from AI-generated slop in curl's disclosed reports.

Bug Bounty Village·23 min

• DEF CON
• AI Security
• Date: Aug 2026
• Location: Las Vegas

Samantha Pearlstein

Shows how a team building AI agents to test API business logic learned from its early failures, covering harness design and how to validate flaws.

Bug Bounty Village·52 min

• DEF CON
• Policy
• Date: Aug 2026
• Location: Las Vegas

Kat · Jay · Sachin · Austin Sturm

Bug bounty program managers describe how AI is reshaping their report volume, triage workload, scope decisions and severity scoring.

Bug Bounty Village·21 min

• DEF CON
• Policy
• Date: Aug 2026
• Location: Las Vegas

Albin Vattakattu · Ryan Nolette

Follows a single cloud vulnerability report from vague first claim through triage, embargoed vendor disclosure, and public release, then proposes three principles for modern disclosure programs.

Bug Bounty Village·24 min

• DEF CON
• AppSec
• Date: Aug 2026
• Location: Las Vegas

Bruno Mendes · Rafael Silva

Shows how to turn a black-box arbitrary file write into remote code execution by fingerprinting the runtime and overwriting predictable framework files.