Make Money Hacking AI

The talk treats AI systems as targets rather than tools, and argues that people can earn real money by breaking them through competitions, public bug bounty programs, private programs and contract work. The speakers begin with a multi-level capture-the-flag style contest in which the goal was to make a chatbot reveal a hidden phrase. Early levels fell to short, token-light tricks that exploited how the model interpreted identifier-like inputs. Later levels stacked an input filter, a separate model that screened prompts, and a sandwich defense inside the system prompt. The speakers mapped these layers by black-box probing and then bypassed them with long, staged prompts.

The middle section covers larger jailbreak competitions with prompts that worked across several vendors' models, and a prompt-injection case against an AI coding IDE. Instructions were hidden in markdown comments that the agent read but the developer did not see. An allowlist that approved commands by their leading word let a command substitution run a remote script without the confirmation prompt that would normally appear. The speakers split methodology into security testing, such as enumerating tools and connectors, finding exfiltration paths, extracting system prompts and checking classic web bugs, and safety testing, which relies on jailbreak technique families.

They close with approximate earnings from the past year, note that private programs pay most, and discuss a chatbot with no tools whose wrong refund advice a court held the airline responsible for. The practical takeaway is to start with competitions and public programs, and to expect the hardest work to be convincing vendors that hallucinations are reportable risk.