SecMantra
Waitlist openBeginnerOffensive security

Bug Bounty Hunter in the Agentic AI Era

Go from zero to your first bug bounty report, and learn to hunt the bugs AI agents create.

Duration
12 weeks
Effort
48 hours
Lessons
65
Level
Beginner
Join the waitlist See the curriculum

Starts from zero

Week one explains how the web works. Every lesson builds on the last, with short videos and guided labs.

Built for AI agents

Half the hands-on work targets AI chat features and agents, mapped to the latest OWASP standards.

Learn to get paid

Programs pay for real impact. You learn to prove it, report it clearly, and pick programs where beginners win.

What you'll be able to do

  • Explain how websites, APIs and AI agents work, in plain language
  • Set up a safe hacking lab and use Burp Suite and browser developer tools
  • Find and prove the web bugs that still pay: access control, IDOR, XSS, SSRF and logic flaws
  • Test AI chat features and agents against the OWASP LLM and Agentic Top 10
  • Use AI tools to speed up recon and reporting without breaking program rules
  • Read a program's scope, stay within the law, and write reports that get paid
  • Choose programs and follow a realistic 90-day plan toward your first bounty

Who it's for

Career switchersIT support, QA, sysadmins and developers who want a practical way into security.
Students and graduatesAnyone in a technical or semi-technical field looking for a skill employers need now.
AI enthusiastsPeople who use ChatGPT, Claude or Gemini every day and want to understand how they break.
Builders of AI productsDevelopers and product people who want an attacker's view of what they ship.

You'll need: A laptop with 8 GB of RAM or more, a modern browser, and comfort installing software.

Curriculum

4 parts, 11 modules, one capstone

Mapped to the OWASP Top 10 for LLM Applications 2025 and the OWASP Top 10 for Agentic Applications 2026.

65 lessons13 hours of video48 hours total with labs
Part 1

Foundations

Weeks 1–2 · 9 hours
Module 00Welcome, ethics and the law2 h

Know what the job is, how hunters get paid, and the rules that keep you safe and legal.

  1. What a bug bounty hunter does10 min
  2. How bug bounty works: programs, triage and payouts12 min
  3. Why the AI era changes the game10 min
  4. Ethics and the law: authorization, scope and safe harbor15 min

LabRead a real program policy and complete a scope worksheet.

Module 01How the web and APIs work4 h

Explain what happens between clicking a link and seeing a page, which is where every bug lives.

  1. What happens when you open a website12 min
  2. HTTP, the language of the web15 min
  3. How logins work: cookies, sessions and tokens15 min
  4. The browser: HTML, JavaScript and the DOM15 min
  5. APIs and JSON12 min
  6. Behind the scenes: databases and cloud storage10 min

LabA developer-tools treasure hunt on OWASP Juice Shop.

Module 02Your hacking lab and toolkit3 h

Build a safe lab and intercept, change and replay web traffic.

  1. Build a safe lab with Docker and Juice Shop15 min
  2. Burp Suite: proxy, history and Repeater15 min
  3. Intruder basics, Caido and OWASP ZAP10 min
  4. The command line for hunters15 min
  5. Notes and evidence: your hunting journal8 min

LabIntercept a login, modify it in Repeater, and solve three beginner challenges.

Part 2

Classic hunting

Weeks 3–6 · 14 hours
Module 03The web bugs that pay10 h

Find, prove and rate the most commonly paid bug classes.

  1. How hunters think12 min
  2. Broken access control and IDOR15 min
  3. Authentication flaws15 min
  4. Cross-site scripting (XSS)15 min
  5. Injection: SQL and command injection15 min
  6. Server-side request forgery (SSRF)12 min
  7. Business logic bugs and race conditions15 min
  8. Information disclosure10 min
  9. CSRF and CORS12 min
  10. Rating severity with CVSS10 min

Lab12 PortSwigger Web Security Academy labs plus matching Juice Shop challenges.

Module 04Recon and choosing programs4 h

Map what a target exposes, stay in scope, and pick programs where beginners can win.

  1. Reading scope like a pro10 min
  2. Finding assets with passive recon15 min
  3. Mapping the app and its hidden APIs15 min
  4. Spotting AI features on a target12 min
  5. Choosing your first programs12 min

LabBuild an attack-surface map for a real in-scope program.

Part 3

The AI era

Weeks 7–10 · 17 hours
Module 05How LLM apps and agents work3 h

Draw how an AI app is built and point to every place untrusted text gets in.

  1. LLMs in plain English12 min
  2. System prompts and context windows10 min
  3. RAG: how AI reads your documents10 min
  4. Tools and function calling12 min
  5. Agents: plan, act, observe, remember12 min
  6. MCP and connectors12 min

LabWatch an agent think: proxy a demo agent and map its tools and calls.

Module 06Hacking LLM applications6 h

Test any AI chat feature against the OWASP LLM Top 10 and tell a finding from a curiosity.

  1. A tour of the OWASP LLM Top 1015 min
  2. Prompt injection, direct and indirect15 min
  3. Leaking secrets and system prompts12 min
  4. When AI output becomes an exploit15 min
  5. RAG leaks between users12 min
  6. Cost abuse and misinformation10 min
  7. A repeatable AI test checklist12 min

LabGandalf warm-up, PortSwigger Web LLM attack labs, and the SecMantra AI chat lab.

Module 07Hacking AI agents6 h

Chain an indirect prompt injection into an impact programs pay for.

  1. The agentic attack surface: Source, Agent, Sink15 min
  2. Agent goal hijack15 min
  3. Tool misuse and excessive agency15 min
  4. Identity, privilege and the confused deputy12 min
  5. MCP and the agent supply chain12 min
  6. Getting data out: exfiltration channels12 min
  7. Code execution, memory poisoning and multi-agent trust15 min
  8. Fooling the human in the loop10 min

LabThe SecMantra agent lab: from a planted document to a proven data leak, then the fix.

Module 08AI as your hunting partner2 h

Use AI to work faster while keeping every finding human-verified.

  1. Where AI helps12 min
  2. Where AI hurts: invented bugs and AI slop reports10 min
  3. Program rules and data handling10 min
  4. Your AI-assisted workflow12 min

LabReview a lab app's JavaScript with AI, then verify every claim by hand.

Part 4

Getting paid

Weeks 10–12 · 5 hours
Module 09Reports that get paid3 h

Write reports that are accepted, rated fairly and paid quickly.

  1. Think like a triager10 min
  2. Anatomy of a great report15 min
  3. Reporting AI bugs15 min
  4. Duplicates, N/A and severity disputes10 min
  5. Disclosure and your portfolio10 min

LabRewrite three weak reports, then write a full report for your agent finding.

Module 10Platforms, programs and your career2 h

Leave with three chosen programs and a realistic 90-day plan.

  1. The platforms: HackerOne, Bugcrowd, Intigriti, YesWeHack, huntr12 min
  2. AI bounty programs and what they pay for10 min
  3. Your first 90 days12 min
  4. Money basics8 min
  5. From hunter to career12 min

LabPick three programs, one with AI scope, and build your 90-day plan.

Capstone · 3 hours

Capstone hunt

Hunt a SecMantra-built practice company with eight planted bugs across its website, API and AI shopping assistant. Find at least three, including one AI or agent bug, and submit full reports graded on reproducibility, impact, clarity, fix and ethics.

Certificate

SecMantra Certified AI Bug Hunter

Complete at least 80% of module checkpoints and score 70 or more out of 100 on the capstone. Each certificate has a verification link you can add to LinkedIn.

Formats

Choose how you learn

Self-paced

All videos, lab guides, checklists and quizzes, with lifetime access and updates as AI threats change.

Live cohort

Everything in self-paced, plus 12 weekly live sessions, office hours, a learner community and an instructor-graded capstone.

Teams

A private cohort for your engineering or security team, adapted to your stack, with progress reporting.

FAQ

Common questions

Do I need to know how to code?

No. The course explains everything it uses. Optional sidebars go deeper for learners who already code.

Is this legal?

Yes. You practise only on training labs built for hacking, and on real programs only within the scope they publish. Module 0 covers the law and the rules before any hands-on work.

How much time do I need each week?

About 4 hours a week for 12 weeks. Self-paced learners can go faster or slower.

Will I earn money from bug bounties?

Many learners aim for a first bounty, but results vary with time, practice and luck, and we can't promise income. The course gives you the skills, a method and a plan.

What computer do I need?

A Windows, Mac or Linux laptop with at least 8 GB of RAM. All tools used are free.

Can my company enrol a team?

Yes. Choose Teams on the waitlist form or email [email protected], and we'll tailor a private cohort.

Join the course waitlist

Get first access to AI Bug Bounty Hunter, early-bird pricing, and the date the first cohort starts.

Questions? [email protected]

Preferred format