Episode 123: Hacking AI Series: Vulnus ex Machina - Part 2

Episode 123: In this episode of Critical Thinking - Bug Bounty Podcast we’re back with part 2 of Rez0’s miniseries. Today we talk about mastering Prompt Injection, taxonomy of impact, and both triggering traditional Vulns and exploiting AI-specific features.
Follow us on twitter at: x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout toYTCracker (twitter.com/realytcracker) for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater and Rez0 on Twitter:
x.com/Rhynorater
x.com/rez0__
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at ctbb.show/merch!
Today’s Sponsor - ThreatLocker User Store
criticalthinkingpodcast.io
/tl-userstore
====== This Week in Bug Bounty ======
Earning a HackerOne 2025 Live Hacking Invite
hackerone.com/blog/earning-hackerone-2025-live…
HTTP header hacks: basic and advanced exploit techniques explored
yeswehack.com/learn-bug-bounty/http-header-exp…
====== Resources ======
Grep.app
vercel.com/blog/migrating-grep-from-create-rea…
Gemini 2.5 Pro prompt leak
x.com/elder_plinius/status/1913734789544214841
Pliny's CL4R1T4S
github.com/elder-plinius/CL4R1T4S
O3
x.com/pdstat/status/1913701997141803329
====== Timestamps ======
(00:00:00) Introduction
(00:05:25) Grep.app, O3, and Gemini 2.5 Pro prompt leak
(00:11:09) Delivery and impactful action
(00:20:44) Mastering Prompt Injection
(00:30:36) Traditional vulns in Tool Calls, and AI Apps
(00:37:32) Exploiting AI specific features