AI is now part of vulnerability workflows
Claude Security, Mythos and coordinated disclosure programs show a clear direction: models and agents are being used to find, reproduce and explain flaws at greater scale. That fits defensive research, code review and bug bounty work, but it does not turn every app into a free target.
For a small SaaS, the useful question is not "which agent finds more CVEs?". The question is what you let an agent inspect, with what authorization, in which environment, without exposing customers or running destructive tests.
What changes for founders
- Scanners and agents can generate signals faster.
- Not every signal is exploitable, urgent or commercially relevant.
- Evidence must be clean: no secrets, no customer data and no destructive payloads.
- Testing third-party systems still requires authorization.
- Bug bounty needs scope, rules, severity, impact and controlled reproduction.
- AI can help draft analysis, but it should not own risk judgment alone.
Where to use it well
Use agents to review diffs, find weak auth patterns, explain flows, list surfaces and generate better questions. Do not use agents to attack production, scan third parties or execute payloads without authorization.
When the signal involves login, paid plans, customer data, uploads, integrations or admin access, the next step is not "run one more tool". It is to separate evidence and request a Risk Review to decide impact, priority and scope.
What RET should validate
- Does the bug enable cross-customer access?
- Does it affect billing, paid access or digital delivery?
- Is the precondition rare or a common product path?
- Can evidence be shared without sensitive data?
- Does the patch include a regression test?
- Should this become a formally authorized manual pentest?
Sources
AI can accelerate discovery. Product-aware humans still decide risk, scope and impact.
