An elite security researcher has flagged concerns that the bug bounty competition era may be coming to an end, as AI systems become sophisticated enough to outpace even the most talented security professionals. Valentina Palmiotti, operating under the name Chompie, emerged as the most successful individual competitor at Pwn2Own Berlin, the world’s most prestigious hacking competition, where she earned close to $70,000 in rewards by identifying severe security flaws in leading software platforms. Yet notwithstanding her success, she raised alarm that cutting-edge machine learning models—particularly Claude Mythos, developed by Anthropic—will shortly render it unfeasible for security researchers to participate. “I took part in Pwn2Own this year because I thought it might be my last chance,” she informed BBC News, underscoring concerns that artificial intelligence-based flaw detection will fundamentally transform the ethical hacking sector and bug bounty programmes.
The Pwn2Own champion’s defining moment
Chompie’s leading position at Pwn2Own Berlin demonstrated the exceptional skill necessary for success at the most challenging globally hacking challenge. On the first day of the competition, she performed a sophisticated attack against an Nvidia-linked system, earning $20,000 for her work. Rather than rest on her laurels, she straight away headed back to her accommodation to ready herself for the following task, entering what she refers to as “zombie hacker mode”—an intense state of non-stop labour sustained by energy drinks and adrenaline that went on throughout the night.
The cost of this relentless pursuit became clear when footage from the competition showed Chompie on stage looking simultaneously elated and exhausted after gaining access to a Linux-based system to secure an additional $50,000 prize. She had worked from 6pm until 6am without sleep, a punishing twelve-hour marathon that she admitted was far from healthy. Yet such commitment has become common practice amongst elite competitors, who drive themselves to extreme limits of human endurance to achieve wins at the renowned yearly competition. Chompie’s total earnings of almost $70,000 reflected not just technical skill but absolute commitment.
- Compromised Nvidia-linked system for $20,000 on the first day
- Worked twelve hours straight without sleep for second attempt
- Successfully breached Linux system earning extra $50,000
- Described the intense competitive state as a “zombie hacker” condition
How machine learning is revolutionising the security threat terrain
The incorporation of artificial intelligence into security operations has substantially changed how security researchers conduct their work. Tools like Claude Code have proved to be essential resources, allowing researchers to enhance their vulnerability discovery processes and streamline their assessment approaches. For competitors like Chompie, these intelligent platforms have offered a competitive edge during intense extended competitions, permitting them to function at higher efficiency whilst sustaining the demands required to perform at top-tier events. The technology has democratised certain aspects of vulnerability research, rendering sophisticated methods more available to a broader range of security professionals globally.
However, this digital transformation has introduced a concerning contradiction. Whilst current AI models function as helpful supplements to human expertise, more advanced systems risk render human competitors obsolete completely. Anthropic’s Claude Mythos has already demonstrated the magnitude of this disruption, said to have uncovered 1,600 security flaws throughout numerous software applications—a capacity that far exceeds what individual hackers can accomplish through traditional methods. The company has limited availability to government bodies and specialist security organisations, acknowledging the potential for both beneficial and harmful applications of such advanced systems.
The existing edge for human researchers
At this time, ethical hackers occupy what Chompie describes as a “sweet spot” where artificial intelligence operates as an enabler rather than a replacement. Contemporary AI tools perform well in accelerating routine tasks, automating code analysis, and suggesting research directions that might otherwise necessitate hours of manual investigation. For security researchers working in high-pressure environments—whether competing at Pwn2Own or conducting vulnerability assessments for organisations like IBM X-Force—these tools have become essential productivity multipliers. The human element remains crucial, requiring creativity, intuition, and strategic thinking that current AI systems cannot fully replicate.
This combined advantage has enabled champions to advance their performance boundaries further than previously possible. By transferring processing-intensive tasks to machine learning systems, leading penetration testers can concentrate their intellectual capacity on addressing sophisticated problems and novel attack vectors. The technology has enhanced human potential rather than replaced it, establishing a symbiotic relationship where human expertise and machine processing are essential for accomplishing goals. Yet this balance looks unsustainable, with increasingly advanced systems already in development.
The upcoming turning point
The cybersecurity community faces an imminent technological inflection point as next-generation AI models materialise. GPT 5.5 Cyber and comparable platforms promise capabilities that will substantially surpass human performance in vulnerability discovery. Unlike current tools that enhance researcher capabilities, these advanced models are designed to operate with minimal human intervention, potentially identifying and exploiting security flaws at speeds and scales that humans cannot match. This shift constitutes a pivotal juncture for the competitive hacking community, where traditional skills may prove inadequate against AI-driven approaches.
Chompie’s choice to participate at Pwn2Own this year reflects a broader anxiety within the hacking community about the continued feasibility of human competition. As AI systems develop greater capability, the window for human-dominated bug bounties and security contests may rapidly close. The restriction of Claude Mythos to specific organisations underscores how seriously technical specialists view this threat, yet such limitations offer only temporary reprieve. The period of competitive vulnerability discovery that has characterised ethical hacking for decades appears ready for fundamental shift within the coming years.
Contrasting viewpoints on the future of humanity in cybersecurity
Whilst Chompie’s worries about AI dominance reverberate within the cybersecurity sector, not all IT security specialists share her pessimistic outlook. Some argue that human creativity, innovation and instinct will always hold core importance in vulnerability research. They point to the unpredictable nature of cybersecurity threats and the significance of situational awareness that machines have trouble reproducing. These optimists contend that rather than replacing human hackers, advanced AI will keep developing as a resource that enhances the entire profession, allowing researchers to tackle increasingly complex problems whilst preserving human control and ethical safeguards.
The conversation illustrates a wider divide within cybersecurity regarding technical innovation and career identity. Industry leaders recognise that AI will inevitably reshape bug bounty programmes and organised hacking challenges, but they stress that human skill stays essential in key decision-making and risk evaluation. Organisations such as Anthropic have intentionally controlled access to powerful models precisely because they acknowledge the risks of unregulated AI-based vulnerability identification. This measured approach points to the time ahead may include integrated systems where people and artificial intelligence operate in partnership under tight controls, as opposed to total substitution of human security experts with self-governing systems.
- Human creativity essential for new offensive approaches AI cannot anticipate
- AI regulation and restricted access may protect market advantages
- Hybrid human-AI teams expected to shape cybersecurity’s future landscape
Implications for both defensive and offensive players
The expansion of AI-powered vulnerability discovery presents a dual-edged sword for the cybersecurity landscape. Whilst security professionals and vulnerability experts have historically functioned as the primary defensive barrier, identifying flaws before malicious actors can leverage them, the widespread availability of AI tools threatens to level this playing field. If powerful models gain broad access, cybercriminals could theoretically identify flaws at scale, possibly exceeding the ability of security teams to apply fixes. This asymmetry could fundamentally alter the cost dynamics of cybersecurity, compelling businesses to allocate substantially greater resources in protective strategies and rapid response capabilities to offset accelerated threat discovery.
Conversely, the identical AI capabilities could enhance defensive operations significantly. Security teams equipped with cutting-edge AI systems could theoretically detect and fix vulnerabilities at unprecedented speeds, potentially remaining ahead of threats. The key factor lies in control and oversight. If AI vulnerability discovery tools remain strictly limited to approved security organisations and governments, as Anthropic currently ensures with Mythos, defenders may retain their advantage. However, should such technologies eventually leak or be deconstructed, the consequences could be serious, making the matter of careful implementation and access controls critical for cybersecurity’s future stability.
The criminal hacker realm
The prospect of AI-assisted flaw identification in the hands of cybercriminals constitutes perhaps the most alarming scenario facing the security community. Malicious actors have consistently demonstrated their ability to weaponise new technologies more quickly than defenders can adapt. If organised crime groups gain access to models like Mythos, they could conduct automated searches for exploitable flaws across vast swathes of software and infrastructure, essentially automating the vulnerability discovery process. This would grant them unprecedented speed and breadth in locating targets, potentially overwhelming the capacity of security researchers and security teams to respond adequately.
Anthropic’s choice to limit Mythos access demonstrates keen understanding of this risk. The company explicitly acknowledged the model’s capacity for abuse, limiting distribution to select governments and cybersecurity institutions. This gatekeeping approach, whilst controversial, represents a practical acknowledgement that unfettered AI access could enable unlawful organisations to an unequal degree. However, such restrictions may turn out to be short-lived. Evidence indicates that advanced systems eventually proliferate beyond their intended boundaries, raising uncomfortable questions about the duration for which ethical implementation approaches can contain instruments created expressly to uncover concealed vulnerabilities in digital infrastructure.
Responsible introduction as the key consideration
The future direction of ethical hacking and cybersecurity depends significantly on how the technology industry oversees AI vulnerability discovery tools. Establishing robust governance frameworks, access controls and accountability mechanisms will be critical for preventing misuse whilst supporting legitimate security research. Industry collaboration between technology companies, security researchers, governments and law enforcement could help establish standards for accountable implementation. Such frameworks might incorporate restricted licensing agreements, usage monitoring, and international cooperation to stop tools getting to criminal networks. Without proactive governance, the strategic advantage currently held by ethical hackers could diminish within years.
Chompie’s choice to take part at Pwn2Own whilst the chance persists reflects a broader urgency within the ethical hacking community to create standards and safeguards before AI substantially transforms the landscape. Cybersecurity experts, policymakers and technology companies must collaborate to guarantee that advanced artificial intelligence systems reinforce rather than weaken cybersecurity protections. This demands openness regarding functionality, accurate evaluation of risks, and readiness to enforce limitations that may inconvenience researchers but protect critical infrastructure. The window for establishing responsible standards may be closing, making immediate action vital to maintaining human expertise and ethical oversight in an rapidly mechanised security ecosystem.