Careers, Bounties, and What to Learn Next
Thirty days ago the premise was simple: agents have hands now, and the security industry has not caught up. You have spent four weeks building both halves, offense and defense, and yesterday you turned that into a repeatable methodology. Today is not a technique day. It is a map of where this goes next, because knowing the attacks is the first half of the job. Knowing where to point them is the second.
Where the work actually is right now
Four distinct paths have opened up, and they pay differently, ask for different proof, and suit different temperaments.
1. Bug bounty on agentic targets
This is the fastest path to a first paycheck, because the targets already exist. Every company that shipped a coding assistant, a support chatbot with tool access, or an MCP integration is a live target the moment it ships.
What to actually do:
- Filter bounty programs for AI features. Many programs now have a dedicated AI or LLM category, and some pay a premium for prompt injection with demonstrated impact, not injection alone.
- Treat every chatbot with a knowledge base as a candidate for indirect injection. Treat every agent with a connected tool as a candidate for the lethal trifecta.
- Lead with chains, not jailbreaks. A report that says “I got the model to say something bad” gets closed as informational. A report that says “a public support ticket can make the agent exfiltrate another customer’s order history” gets paid.
- HackerOne’s own numbers back this up: prompt injection reports grew 540 percent year over year, and AI vulnerability payouts crossed two million dollars. The category is young enough that competition is thin and old enough that programs now budget for it.
The ceiling here is real money for an individual hunter, with no gatekeeper beyond the report itself.
2. In-house AI red team and AppSec roles
Companies deploying agents internally need someone who can test them before a customer or an attacker does. This is less glamorous than bounty hunting but pays a stable salary and gives you the deepest access, since you get to see the system design, not just the public surface.
What gets you hired:
- A portfolio of your lab work. The Day 28 red team assessment you produced is exactly the artifact a hiring manager wants to see, because it proves you can both attack and report.
- Fluency in the frameworks from Day 27. Being able to map a finding to OWASP’s agentic categories and NSA’s MCP guidance signals you can communicate with a team that has its own risk language.
- Comfort reading code, not just prompting. Most real findings in this series came from understanding how MCP servers, tool routers, and memory stores are actually built. Teams want someone who can read that code, not someone who only talks to the chat interface.
3. Independent research and disclosure
The postmark-mcp and LiteLLM cases from Day 1 were found by people who went looking, not people who waited for a program to invite them. Publishing original research, a novel attack class, a widely used tool’s vulnerability, a new technique, builds reputation faster than any single bounty.
This path is slower to pay directly but compounds. A well written writeup gets cited, gets you invited to private programs, and often gets you a job offer before it gets you a bounty.
4. Building the defenses
Every attack you learned implies a product. Dual LLM orchestration layers, flow control proxies, tool pinning and diffing services, agent-specific logging and detection, agent-aware WAFs. This series gave you the attacker’s view of exactly what each of these needs to stop. That view is the hardest part of building them well, and it is in short supply.
If you are more builder than breaker, this is the highest leverage place to point four weeks of offensive knowledge.
What separates a strong candidate from a weak one
Across all four paths, the same signals matter.
Can you demonstrate a full chain, not a trick. Anyone can paste a jailbreak and get a funny response. Can you show entry to target to exit, with a measured success rate, the way Day 29 taught you to report it.
Do you understand the protocol, not just the prompt. MCP internals, tool schemas, OAuth flows in agent contexts. The bugs that pay are increasingly in the plumbing, not the conversation.
Can you write. Every path above is bottlenecked on communication. A finding nobody can read is a finding nobody fixes, and a writeup nobody understands is research nobody cites.
Do you keep a lab. The single highest leverage habit from this series is the one you were told to build on Day 7: your own vulnerable MCP server and agent environment. Keep updating it as new attack classes emerge, because reproducing an attack yourself, before you report it anywhere, is what turns a guess into a finding.
What to learn next
The field is moving fast, so treat this as a syllabus for the next quarter, not a final exam.
Protocol depth. Go past MCP to the other agent-to-tool protocols emerging alongside it, and read their security sections, not just their quickstarts.
Multi-agent systems. Everything in this series assumed one agent. When agents call other agents, the trust boundary problem multiplies, and almost nobody has solved it yet. This is the next frontier and it is wide open.
Supply chain tooling. Day 2’s postmark-mcp and Day 13’s LiteLLM cases are a pattern, not an anomaly. Learn to pin, diff, and verify tool and dependency provenance at a level most teams still do by hand.
Applied cryptography for agent identity. Confused deputy problems, Day 11’s whole subject, keep coming back to weak binding between tokens and intent. Understanding how to properly scope and bind credentials is a durable skill that outlives any specific CVE.
The defender’s literature. Read the dual LLM and information flow control papers behind Day 23 and 24 in full, not just the summary you got here. The primary sources go deeper than any single post can.
Staying current without drowning
This space generates more noise than any security niche. A simple filter: follow the people who publish reproducible findings with working proof of concept code, not the people who only post predictions. Track CVE and KEV feeds for MCP and agent framework entries specifically, the way Series C on this blog does weekly. And re-run your own lab’s test suite, Day 29’s chain list, against any new model or framework release, because what held against one model does not automatically hold against the next.
Closing the loop
Four sentences opened this series on Day 1. They are worth repeating now that you have built everything they imply.
- Anything that enters the context window is potentially an instruction, regardless of where it came from.
- An agent’s effective permissions are the union of every tool it can reach, not the permissions of the user who asked.
- Any outbound channel is an exfiltration channel, including ones that look like output formatting.
- Compromise does not require a vulnerability in the traditional sense. It requires influence over what the agent reads.
You now have thirty days of concrete work behind each of those sentences: the labs, the CVEs reproduced, the defenses built, the assessment written. That is not a finished education. It is a foundation solid enough to keep building on, in whichever of the four paths above fits you.
Homework for Day 30, and beyond
- Pick one of the four paths. Write down the first concrete action, a bounty program to target, a job posting to apply to, a finding to write up, or a tool to start building, and do it this week.
- Publish your Day 28 assessment, or a cleaned version of it, as a public writeup. It is your proof of work.
- Set a recurring weekly slot to check KEV and CVE feeds for agent and MCP entries, the way Series C does.
- Re-run your lab’s full chain list against one model or framework you have not tested yet, and note what changed.
- Revisit this series in three months. Agent security moves fast enough that half of what felt cutting edge on Day 1 will be baseline by then, and the gaps that remain will tell you exactly what to study next.
Thank you for building through all thirty days. The lab stays up on HACKLIDO, the attacks keep getting reproduced, and Series C keeps tracking what is newly exploited every two weeks. See you there.
This series is published on HACKLIDO. Labs referenced throughout are available in the HACKLIDO lab environment.
