Open-weight model research in VDPs: what practitioners need to act on

TL;DR: An open-weight model powered its number one HackerOne VDP research operation for a second consecutive quarter, cutting cost per submission by roughly 30% while producing 3.5% false positives and 91% fully validated reports, according to Tenzai. Autonomous vulnerability discovery is now a present operational risk, not a future scenario, and defenders are running out of time to rely on old remediation cadences.

Editorial analysis by NHI Mgmt Group, based on content published by Tenzai: “An open-weight model powered the #1 HackerOne VDP research operation”.

By the numbers:

• Tenzai says it reduced its cost per submission by roughly 30%.
• Tenzai says it submitted more than 300 reports to 94 organizations covering 133 assets.
• Tenzai says 3.5% of findings were false positives and 91% of reports fully validated.

Key questions

Q: How should security teams defend against autonomous vulnerability research at scale?

A: Treat autonomous discovery as a continuous exposure-management problem, not a point-in-time testing exercise.

Q: Why do authentication bypasses become especially risky when AI tools can test them continuously?

A: Because auth bypasses often expose reusable trust mistakes in token issuance, session handling, or federated login logic.

Q: What breaks when session minting and token validation are too permissive?

A: Privilege boundaries break first.

Practitioner guidance

• Tighten auth-flow testing coverage Prioritise automated and manual tests for session minting, token validation, SAML assertions, JWT verification, and unauthenticated account change paths, because those are the control points the article shows can be broken at scale.
• Shorten remediation and review cycles Rework triage and fix SLAs around continuous discovery rather than periodic review, especially for findings that are easy to re-identify or chain into deeper compromise.
• Use bug bounty findings as control telemetry Feed validated reports into IAM, application security, and risk dashboards so repeated weakness patterns influence backlog priority, not just individual remediation tickets.

Bottom line: Autonomous research is already finding and validating real weaknesses across identity and application controls, which changes how defenders should think about exposure management.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →