Pentesting

A detailed bug bounty writeup. Our autonomous agent KLUE spent hours proving a hardened crypto-mining marketplace was hardened, then reverse-engineered its HMAC signing scheme, mapped a STOMP WebSocket buried in the authenticated app bundles, and discovered it performed no authentication at all, routing private per-tenant channels off a client-supplied parameter. An unauthenticated, cross-tenant data leak, responsibly disclosed and rewarded.

We ran KLUE against the same live production target four times, once each behind GLM 5.2, DeepSeek V4 Pro, Kimi K2.7 and Opus 4.8, all on an identical thirty minute budget. Same target, same clock, four risk verdicts from Low to Critical. A field report on what each model sees, what it walks past, whether it got the severity right, and why the cheapest run came back with the most.

We ran four frontier models through the same autonomous pentest engagement. Recall, time to finish, and dollars per run all tell different stories, and Kimi K2.6 turned out to be the surprise on the leaderboard.

A case study from an autonomous AI pentest run by KLUE. Eleven confirmed findings in just over an hour, including a blind SQL injection that led to full database takeover. A practitioner walkthrough of the discoveries, the methodology, and the takeaways.

A practical JWT security guide covering what JWT is, common JWT vulnerabilities, JWT attacks, exploit techniques, and defensive best practices for developers, pentesters, and API security teams.