# How I hunt for vulnerabilities with AI

DevFeed: [How I hunt for vulnerabilities with AI](<https://devfeed.tech/articles/how-i-hunt-for-vulnerabilities-with-ai-5283.md>)

Original publisher: [Read original article](<https://clickhouse.com/blog/how-i-hunt-for-vulnerabilities-with-ai>)

Author: Tsvetan Stoychev

Published: 2026-06-26T11:24:26Z

Content type: article

Language: en

Sources: [ClickHouse Blog](<https://devfeed.tech/sources/clickhouse-blog.md>)

Topics: [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Bug Bounty](<https://devfeed.tech/topics/bugbounty.md>), [clickhouse](<https://devfeed.tech/topics/clickhouse.md>), [C++](<https://devfeed.tech/topics/c-plus-plus.md>), [Security](<https://devfeed.tech/topics/security.md>), [Code](<https://devfeed.tech/topics/code.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [bug-bounty](<https://devfeed.tech/tags/bug-bounty.md>), [c-plus-plus](<https://devfeed.tech/tags/c-plus-plus.md>), [claude](<https://devfeed.tech/tags/claude.md>), [clickhouse](<https://devfeed.tech/tags/clickhouse.md>), [code](<https://devfeed.tech/tags/code.md>), [copilot](<https://devfeed.tech/tags/copilot.md>), [ctf](<https://devfeed.tech/tags/ctf.md>), [gemini](<https://devfeed.tech/tags/gemini.md>), [github-copilot](<https://devfeed.tech/tags/github-copilot.md>), [guest-post](<https://devfeed.tech/tags/guest-post.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

This guest post explains how an experienced software engineer used GitHub Copilot with Claude Opus and Gemini models to investigate vulnerabilities in the large C++ ClickHouse codebase. The workflow used AI to search code, generate hypotheses, and accelerate validation in local environments, leading to several real vulnerability reports.

## Source excerpt

I'm an experienced software engineer, but I'm not a seasoned bug bounty hunter. I used GitHub Copilot in combination with Claude Opus and Gemini models to search for vulnerabilities in the ClickHouse codebase, generate hypotheses, and speed up validation.