Finding flaws with LLMs and agents is changing bug bounty programs. But it's not necessarily changing how orgs fix those flaws. Shlomie Liberow shares his experience across a decade of bounty programs and how they have changed for researchers and orgs. He explains why fixing the bug reported through a bug bounty is more about understanding interconnected systems than fixing a single piece of software. We discuss how orgs can be more effective at securing their environment and what role LLMs might have in evaluating controls. Plus, we look to the future of bug bounty programs and how researchers can still excel through curiosity and expertise on a topic rather than relying on scanners, prompts, and luck.
Shlomie is the founder and CEO of aisy. He spent nearly a decade as a hacker and head of Hacker R&D at HackerOne, working alongside Zoom, Salesforce, Capital One, and the Pentagon to find and triage thousands of vulnerabilities, making judgment calls on over $20 million in verified findings. Prior to this, Shlomie protected some of the world’s most high-profile personalities from cyber threats, anticipating risks before they materialized and taking proactive measures to secure against them.
Most security tools hand you a ticket queue. aisy works backwards from the outcomes you’re protecting, connecting findings to the threats that actually matter and pushing recurring patterns to developers’ coding agents, so the same bug class never needs fixing twice.
Identity is baked into your apps, but are you securing it? Misconfigured auth, token misuse, and excessive permissions are creating real risk at the application layer.
So what’s actually exposed?
At the Identity Virtual Cybersecurity Summit on September 30th, learn how to secure authentication and authorization and reduce identity risk in modern applications.
Security Weekly listeners can register for free at https://securityweekly.com/identity using the promo code: CSS26-SW
InfoSec World is introducing a fresh experience for 2026, with new voices, a new venue, and new topics reflecting the challenges security teams are facing now. Join practitioners and leading professionals from across industries in Orlando, October 12–14. Listeners save 30% on their pass with code ISW26-SWSAVINGS at securityweekly.com/infosecworld2026.
Mike Shema
- Muse, Meta’s extraordinarily privileged AI assistant, has a serious 0-day – Ars Technica
- GitHub Actions leaking secrets when Miri output is cached | Rust Blog
- ATT&CKing TACACS+ to Pwn Your Network via a Pre-Auth RCE – elttam
- Agentic Hacks, Real Proofs: Inside Google’s PageBreak Project
- CVE-2026-93616: Directory Traversal and File upload allows execution of arbitrary script on the Management Server
