On July 1, 2026, I am restarting my “100 Days to PWN AI” challenge.

The window is simple:

July 1, 2026 to October 8, 2026.

The public version of this challenge focuses on discipline, research process, and responsible disclosure. I will not publish working exploits, active vulnerable endpoints, private data, or reproduction steps for unresolved vulnerabilities. Until the issues are properly addressed, any information that could facilitate real-world attacks will remain strictly confidential.

What’s Changed?

The first iteration of the challenge was about habit building and momentum. For this reset, the objective is much more targeted: to validate a critical research thesis—that the most high-value AI security vulnerabilities are shifting from the model layer to product logic, permission boundaries, and agent tool execution layers.

While the 2026 financial benchmark of achieving $100,000 in bug bounties remains the metric of validation, the strategic focus must shift.

Minor CORS misconfigurations or informational leaks only create a false sense of progress and will not prove the thesis. I must focus entirely on a small subset of high-impact logic vulnerabilities:

• Cross-tenant data exposure

• Broken Object-Level Authorization (BOLA)

• Knowledge base or retrieval isolation bugs

• Permission failures in agents, tools, connectors, or MCPs (Model Context Protocol)

• Logic flaws in authentication, billing, or execution boundaries

The strategy shifts from merely “finding bugs” to “proving that the AI product’s security model has fundamentally broken at critical junctures.”

Targets and Core Direction

Over the next 100 days, I am prioritizing scoped AI products and programs from frontier AI ecosystems, including OpenAI, Anthropic, and Google’s Gemini / AI ecosystem where permitted by their published rules of engagement. To maintain depth, I will have no more than two active main targets at any given time.

All testing will be conducted only within authorized scopes, published program rules, and safe-harbor boundaries. If a target, workflow, or test case falls outside an approved scope, it will be excluded from the public challenge.

Modern AI products are built on highly complex trust boundaries (spanning organizations, projects, vector stores, tools, and billing). Uncovering vulnerabilities here requires deep, methodical differential testing.

My core thesis is this: The most valuable AI security vulnerabilities in 2026 will stem from product logic flaws surrounding data, identity, tools, and execution contexts—not from model internals or generic infrastructure.

I will focus on validating the following scenarios:

• Unauthorized references to files, memory, source code, or vector databases across workspaces.

• Agents executing sensitive tools without proper authorization.

• Cross-tenant data leakage via shared objects, forks, or caching mechanisms.

• Retrieval-Augmented Generation (RAG) systems leaking private contexts due to disconnected identity validation.

• Privilege escalation and boundary bypasses in billing, organization, or admin logic.

The Execution Plan

The 100-day window is divided into four key phases, designed to iterate quickly and secure high-quality submissions before the end of September:

• July 1 - July 16 | Reset and Setup: Clean up pending high-value reports, configure a local multi-account testing workflow based on Burp Suite, and debug/optimize local AI-assisted testing tools to clear all friction.

• July 17 - August 16 | Attack Surface Mapping & Hypothesis Building: Map out trust boundaries for OpenAI (GPTs/Memory/API), Gemini (AI Studio/Vertex/Workspace), and Anthropic (Tools/MCP). Combine AI-driven reconnaissance with manual analysis to produce a concise registry of testable vulnerability hypotheses.

• August 17 - September 16 | Vulnerability Validation & Early Submission: Enter the deep execution phase. Combine deep manual testing with AI-assisted automation, aiming to submit at least three high-quality reports by September 16. We will enforce a brutal filtering rule: if a hypothesis yields no meaningful progress within a week, demote or dump it immediately.

• September 17 - October 8 | Wrap-up and Q4 Prep: Complete the 100-day challenge review (with cleanup extending to October 16). Focus heavily on triage communication and bounty negotiation to set the stage for Q4 goals.

What I Will Share

I plan to share a series of sanitized technical notes and weekly field updates during these 100 days, but with strict guardrails.

What I will share:

• Research processes and target selection logic

• Anonymized methodologies and AI-assisted bug hunting techniques (e.g., prompt engineering tactics and collaborative agent workflows)

• Insights on building and tuning security tools and scanners (e.g., custom AI-assisted testing scripts)

• Failed vulnerability hypotheses

• Reflections on triage dynamics and bounty economics

• High-level architectural patterns once vulnerabilities are resolved or safe to disclose

What I will not share:

• Active vulnerable endpoints

• Fully functional exploit chains

• Specific details of private programs

• Customer data or screenshots revealing sensitive states

• Exact reproduction steps for unresolved issues

Subscribe now

The Scoreboard and Self-Discipline

In security research, it is incredibly easy to feel busy by collecting domains and running passive scanners. But high-tier bounties only reward those who choose the right attack surfaces, ask the sharpest questions, and demonstrate concrete business impact.

As such, I won’t be tracking the volume of reports. The only scoreboard that matters is:

• 3 to 5 High or Critical vulnerability candidates;

• At least 6 high-quality submissions during the first 90 days of the challenge;

• At least one target entering deep technical or triage discussion, validating the real-world impact and financial viability of logic-based AI safety research.

100 days. Select frontier AI ecosystems. One objective: turn real AI product security failures into high-value, responsibly disclosed bug bounty reports.

About the AIPwn Newsletter

If you’re interested in AI security, the frontier of AI bug hunting, developing custom security tooling, or designing autonomous scanning agents, subscribe to our newsletter. We’ll be sharing sanitized research methodologies and weekly field notes as we go.

👉 Subscribe:

Subscribe now

What I will (and won’t) publish

• ✅ Learning Notes: Key takeaways from worthwhile papers/projects/articles and my transferable reasoning.

• ✅ Dev Reflections: Design trade-offs, parameter choices, costs, and pitfalls while building my AI security automation testing framework.

• ✅ Discovery Ideas: How to identify testable starting points and minimal validation paths across MLSys, open-source models/frameworks, mainstream products & plugins, and multimodal/agent systems.

• ❌ Won’t disclose: Any reproducible exploit details, unpatched risks, or information involving private or production data.

Challenge Goals

• Produce 100 high-quality vulnerability reports.

• Cumulative bounty target: $50,000 (subject to platform/vendor confirmation).

• ≥2 hours of hands-on work per day, with weekly reviews and monthly summaries.

• Release a public (abstracted) version of the AIPwn methodology + automation toolchain.

Challenge Scope

This challenge centers on AIPwn (vulnerability discovery in AI systems) and covers:

1) Vulnerability Types

Prompt Injection | Jailbreak | Data Leakage | Denial of Service | Model Inversion | Multimodal adversarial issues and other emerging categories

2) Target Systems

• Models & Frameworks: Major LLMs (including open-source), RAG/retrieval pipelines, plugins, and tool interfaces.

• Products & Ecosystem: Popular AI products and open-source projects; multimodal systems (image/audio/video/tool calls); multi-agent/agent systems.

3) Methodology

• Develop an AI security automation testing toolkit.

Why this challenge?

AI security matters more than ever. Through this challenge, I hope to:

• Strengthen my professional capabilities in AI security.

• Contribute to the safety of AI products.

• Explore a systematic approach to AI vulnerability research.

• Promote responsible disclosure in AI security.

I’ll share progress regularly on Zhihu and AIPwn. If you’re interested in AI security, let’s connect and discuss!

About the Author

I’m a researcher passionate about AI security, focusing on the area for 8 years, with 10+ years of machine learning/NLP R&D experience. I hope this challenge not only sharpens my skills but also contributes to the AI security community.

I’ll be syncing my research experiences and findings through AIPwn.org as they happen, so feel free to follow along if you’re interested.

Model Security in the LLM Era

Last month, I gave a talk on model security for a big company. Below are a few screenshots from the slides I used at the time. The link to the slides is at the end—feel free to reach out and discuss!

Slides link: LLM时代的模型安全

What AI Bounty Focuses On

I’m still in the learning phase right now and plan to cover all the basics. Currently, very few vendors accept AI vulnerabilities, so the most promising starting point is likely AI infrastructure.

Of course, I’ll also dive into some of the latest topics, like Agent security (which I covered in the slides above) and the recently trending MCP protocol security.

This year is being called the "Year of Agents," so a lot of my effort will go into exploring the expanded attack surface of Agents.

I’ll also be working on some open-source projects related to AI security, which I’ll share via AIPwn.org when the time comes.

Hopefully, in 2025, we all come away with something valuable.

My X: pxiaoer

When embarking on a bug bounty journey, it's best to start by carefully reading the relevant documentation, especially the Program details, which include things you must understand. Treat this as information gathering, read it several times, and form a profile with much of the content.

OpenAI's bug bounty program is hosted on Bugcrowd, link: https://bugcrowd.com/openai

Read more