AI

Everything here happened inside bug bounty programs, in scope and with permission. I reviewed every finding and submitted it by hand. Third-party data is redacted, and the examples were disclosed before publication. For the past few months, I have been testing whether AI can handle the repetitive parts of bug bounty hunting without deciding on its own that a bug is real. Mapping sites, reading JavaScript, comparing requests and revisiting old leads takes time, so I wanted a helper that could keep doing that work and bring me only what deserved a closer look. ...

All issues were responsibly reported to eToro through Bugcrowd and have been acknowledged. Hi, I’m back. This time I wandered somewhere I hadn’t planned to go. I wasn’t hunting for AI bugs at all. I was poking at eToro’s trading platform, the usual stuff, IDOR on portfolio endpoints, parameter tampering, when a little chat bubble caught my eye down in the corner. Torii, eToro’s AI assistant. Ask it about your portfolio, your balances, the market, and it just answers. ...