---
title: "How I hunt for vulnerabilities with AI"
description: "The author describes using AI-assisted code review to hunt for vulnerabilities in ClickHouse, a large C++ codebase, despite having limited bug-bounty experience. GitHub Copilot, Claude, ChatGPT, and Gemini models were used to inspect code, generate vulnerability hypotheses, explain unfamiliar subsystems, and identify older or newly introduced attack surfaces. Promising ideas were recorded, then investigated with Python scripts against a locally running ClickHouse Docker container, followed by manual review and reproduction to distinguish genuine findings from hallucinations and misconfigurations. The work produced a few real vulnerabilities that were reported to ClickHouse’s security team and bug bounty program, while the broader conclusion is that AI can accelerate exploration and validation but still requires persistent questioning and human verification."
---

# How I hunt for vulnerabilities with AI

[Clickhouse](https://yomu.fyi/company/clickhouse) · Jun 26, 2026

**Type:** Tutorial

## Summary

The author describes using AI-assisted code review to hunt for vulnerabilities in ClickHouse, a large C++ codebase, despite having limited bug-bounty experience. GitHub Copilot, Claude, ChatGPT, and Gemini models were used to inspect code, generate vulnerability hypotheses, explain unfamiliar subsystems, and identify older or newly introduced attack surfaces. Promising ideas were recorded, then investigated with Python scripts against a locally running ClickHouse Docker container, followed by manual review and reproduction to distinguish genuine findings from hallucinations and misconfigurations. The work produced a few real vulnerabilities that were reported to ClickHouse’s security team and bug bounty program, while the broader conclusion is that AI can accelerate exploration and validation but still requires persistent questioning and human verification.

## Context

The author wanted to extend AI use beyond autocomplete, prototyping, and documentation lookup, while exploring vulnerability research in ClickHouse. The codebase was considered professional-grade, with no obvious low-hanging security issues, and the author lacked extensive bug-bounty experience.

## Approach / What changed

The workflow combines Visual Studio Code, GitHub Copilot, and other language models to review ClickHouse code, inspect recent changes or targeted subsystems, generate and connect vulnerability hypotheses, and save ideas for later investigation. Selected hypotheses are reproduced with Python scripts against a local ClickHouse Docker container, then checked manually before reporting confirmed vulnerabilities to the appropriate security channels.

## Takeaways

- AI-assisted review can expose unfamiliar code paths and generate vulnerability hypotheses, but repeated ideas, hallucinations, and misconfiguration claims must be filtered by inspecting the source and documentation.
- The validation workflow asks Copilot to create and iteratively correct Python reproductions against a running local ClickHouse Docker container, followed by manual execution and review to check for false positives.
- The author reported a few confirmed vulnerabilities to ClickHouse’s security team and bug bounty program, while emphasizing that the exact prompting strategy may change as language models evolve.

**Tags:** [Docker](https://yomu.fyi/topic/docker), [LLMs](https://yomu.fyi/topic/llm), [Open Source](https://yomu.fyi/topic/open-source), [Python](https://yomu.fyi/topic/python), [Testing](https://yomu.fyi/topic/testing)

- Source: [Clickhouse](https://clickhouse.com/blog/how-i-hunt-for-vulnerabilities-with-ai)
- Source URL: https://clickhouse.com/blog/how-i-hunt-for-vulnerabilities-with-ai
- Ingested by Yomu: 2026-08-29T01:36:58.398Z

[Read original post](https://clickhouse.com/blog/how-i-hunt-for-vulnerabilities-with-ai)