How to start (or come back to) bug bounties in 2026

I saw a post on Reddit the other day that basically said "I've been away from bug bounties for 18 months, what's changed?". I started writing a response and quickly realised that is should be a full blog post.

It's an interesting question because I don't think there has ever been an 18 month period where more has changed. If you blinked at the wrong time you'd be forgiven for thinking you'd landed in a completely different universe. Not everything has changed, in fact many of the fundamentals remain. But a lot did change, and if you're coming back cold or starting fresh, there are a few things worth knowing before you sink a hundred hours into the wrong approach.

So here's how I'd think about starting (or restarting) bug bounties in 2026.

Yes, AI is essential now

AI automation is being used by all the top hunters. It's a core part of the toolkit, the same way Burp or a good recon pipeline is. If you're not using it at all, you're seriously disadvantaged in the arena.

The part people miss is that AI is doing a lot of the work, but it's still at the point where a skilled hacker can guide it in a way that no ordinary person can. That's the whole game right now. The models are very strong, but they're still 10x more powerful being driven by someone who knows what they're doing. You bring that. The AI just brings scale, speed and tirelessness.

Which web vulns should you focus on?

The same ones as always. Go for high and critical impact, always. That hasn't changed and it won't change. Account takeover, auth bypasses, SSRF that actually reaches something juicy, IDORs that leak or modify data at scale, RCE, that's where the money and the reputation are.

If you stumble across a medium on the way, sure, submit it. Money is money. But a medium should never be the goal. Chasing lows and mediums is a treadmill; you'll burn a ton of time for payouts that don't add up to much. Aim high, and pick up the smaller stuff as a side effect of hunting for the big stuff.

Where to find good writeups (it's not Medium)

Medium hasn't been a good source of security writeups for a long time now. It's flooded with low-effort, copy-paste, and misleading content. You have to do some digging to find the good stuff, but it's out there and it's better than ever.

Here's where I'd look:

The Critical Thinking Bug Bounty Podcast is excellent. Genuinely one of the best resources going, real hunters talking about real techniques at a real depth. Start there.

Beyond that, there's a long tail of niche individual blogs run by people who are quietly pumping out incredible content. These are harder to find, but once you find a few good ones you follow them forever.

Any research released by PortSwigger or shubs/Searchlight is gold. If either of them publishes something, read it.

On that note X/Twitter has recently had a real resurgence for the hacker community lately. There was an algorithm change that put us all back on the same timeline, and it genuinely brought the community back together. I find out most of the latest news on X before anywhere else now. Worth being active there again if you drifted off.

Reddit is also still great, so keep looking here. /r/netsec and /r/bugbounty are both worth having in your feed. They effectively surface the big news each day with the reddit upvote system which is nice if you don't want to spend all your time scrolling through mud to find the gold.

How people are actually using AI

A lot of people right now are literally just opening Claude Code, pasting in the scope, and typing "find vulns in this." And it actually works, which is nuts. It finds real bugs. The problem is that it's getting so saturated that you'll be swimming in dupes. If the barrier to running that exact prompt is zero, then everyone runs it, and everyone finds the same low-hanging fruit at the same time.

This is exactly where your hacker brain comes in. You need to keep that bounty mindset and look for the angles other people haven't covered yet... the endpoint nobody's mapped, the second-order interaction, the feature that shipped last week, etc. and then point your AI there. The AI is just a force multiplier. It multiplies whatever direction you give it. If you give it the same direction as everyone else and you get everyone else's results, and vice versa.

Learn the foundations properly

The best free resource for actually learning web hacking is still the PortSwigger Web Security Academy. It's free and it's more thorough than most paid courses. Work through it, and actually do the labs.

HackingHub is also great, and importantly it's run by people who actually succeed at bounties which matters more than you'd think, because a lot of "learn hacking" content is made by people who've never earned a payout in their life, or very little.

Save tokens by making AI build tools, not do chores

This is the single most useful mindset shift I can give you.

When you start using AI seriously, you'll notice really quickly that saving tokens and time becomes a high priority. Tokens cost money and thinking time is slow. The trick is to use AI to create deterministic code and solutions to the problem you're solving (where that's possible), rather than making the AI be the solution every single time.

The naive approach is to say:

"Find all the subdomains associated with example.com"

The AI will then spin up, reason about it, maybe run some tools, and burn a pile of tokens doing something it has to redo from scratch every single time you ask.

The better approach is to say:

"Write a fast tool that discovers subdomains of a given root domain using sources X, Y and Z, then turn the use of that tool into a skill."

Now you've got a deterministic tool that runs instantly, costs almost nothing to invoke, and produces consistent results. Wrap it in a skill and the AI knows exactly when and how to reach for it. Over a month/year of hunting, that difference becomes enormous, both in money and in speed, because a deterministic tool doesn't need thinking time. It's also more consistent.

Do this everywhere you can. Every time you catch the AI doing the same repetitive reasoning task, stop and ask whether it should be writing a tool instead. Build up a library of these. That library becomes your edge, much like how recon setups were an edge 6 years ago.

Reports

Of course, AI is excellent at helping write reports. This is the least controversial use and probably where most people start. A good report is clear, reproducible and communicates impact, and AI is great at taking your rough notes and shaping them into something a triager can action quickly. Just make sure the technical claims are yours and correct. Let it handle the polish, not the substance.

The short version

Build real hacking skills first. Use AI as a force multiplier on top of those skills, not as a replacement for them. Chase high and critical impact. Get your learning from places that haven't been overrun with slop: Critical Thinking, PortSwigger, Shubs, the good niche blogs, X, and Reddit. And when you're working with AI, get in the habit of building fast deterministic tools and skills instead of paying the AI to think through the same problem over and over.

The people winning right now are the hackers who know where to point the thing and how to guide it.

Go find something good.

— hakluke