Bug bounty rewards two things above all: speed and coverage. AI agents are finally good enough to give you both, if you plug them into the right tools.

Large language models can read a target, reason about its attack surface, and write exploit code. What they can't do alone is touch the wire. They don't see the requests your browser sends, they can't replay a mutated payload, and they can't tell you whether a hunch is actually exploitable. That gap is where real hunting lives, and it's exactly what this workshop closes.

Over one intensive, hands-on session, you'll connect Claude Code to Caido, the fast, modern proxy that a growing number of hunters are choosing over the old guard, and build an AI that works with your traffic instead of guessing about it. You won't just watch slides. You'll set up the integration on your own machine, point it at realistic lab targets, and walk out with an agent that hunts alongside you.

Two ways to give your AI eyes and hands. You'll wire the agent to Caido through both integration paths and learn where each one shines:

• A Model Context Protocol (MCP) server, exposing Caido's projects, history, and actions as first-class tools your agent can call.

• Agent Skills backed by a personal access token, a lighter, scriptable approach for teaching the agent bespoke capabilities.

You'll understand the trade-offs, the security implications of each (including where your tokens and secrets actually live), and when to reach for one over the other.

Then you put it to work on the tasks that eat your day:

• Recon and triage at machine speed — have the agent sweep captured HTTP history and surface leaked secrets, tokens, and sensitive values buried in traffic.

• JavaScript reverse-engineering — feed it a minified production bundle and watch it extract every hidden API endpoint, including the ones no crawler found.

• Replay crafting that actually works — auto-generate replay requests with precise, valid bodies for each discovered endpoint, ready to fire (or hold) on your command.

• From detection to confirmation — teach the agent a brand-new skill that drives a Caido plugin to confirm server-side request forgery (SSRF) end to end, turning a suspicion into a validated finding.

This is more than a workshop, it's where you build a co-hunter. Not a chatbot that describes vulnerabilities, but an agent that finds them, reproduces them, and helps you prove impact, with a human firmly in the loop where it matters.

You'll walk away with:

• A working Claude Code + Caido setup running on your laptop.

• Reusable MCP and Skill configurations you can drop into your next engagement.

• A repeatable, AI-driven recon-to-report workflow.

• A clear mental model of what to automate and where human judgment stays non-negotiable.

Who it's for: bug bounty hunters, web app pentesters, and security engineers who want to move faster without losing rigor. Comfortable reading an HTTP request/response and poking at web apps? You're ready.

What to bring: a laptop with Caido community, Node.js/Go, and Claude Code installed (a setup guide goes out before the session). All hunting happens against provided lab targets, under authorization.

Come share your tricks, trade tactics with a room full of builders, and leave hacking smarter. Secure your spot and give your AI the proxy it's been missing. 🚀 #HappyHacking