Luke Stephens (hakluke)

Quick reintroduction, because a lot of you followed me for hakrawler and XSS payloads.

Since then: 3 kids, and a group of cyber companies. HackerContent runs social for cyber brands (some accounts you follow are ours!). Ironbark Cyber does offensive work. TRIAGERS™ handles bug bounty triage. I'm also a partner at Submersion AI, training small cyber models that hold their own against frontier ones.

These days most of my hacking runs through AI agents I built. Most of my consulting is helping businesses hand real work to AI without it blowing up.

That's what I'll post about.

Good to be back.

One of my north star goals is to use AI to make offensive security very cheap.

For so long, smaller orgs like your local hospital or school have not been able to afford cybersecurity services, even though they really need it. I want defence to get cheap first for the people who need it most.

I've been thinking hard about what that looks like, practically.

Recently I've been helping businesses automate real processes with AI. I'm starting to notice some patterns in the way that most people use AI that are mistakes... here's a quick list 👇

First - people naturally want to automate a task rather than a whole process, but then they become a meatsack who just passes AI responses around to different systems. We're at a point now where it's really easy to automate the entire process, not just the sections within that process. For example - when an enquiry from a potential customer lands, don't just use AI to draft the response. Use AI to draft the response, then automatically add them into the CRM, book a call with them, generate a proposal for review, etc.

Second - a lot of AI systems don't define what "done" means. AI is very good at producing what you want - but only if it knows *exactly* what you want. I had a recent client who was trying to get AI to generate work proposals, but they kept coming back with random designs and sloppy filler text everywhere. We had to concretely define a full branding kit, proposal structure, the length and format of each section, language rules, etc. before it would work.

Third - people are bad at defining the boring bits like permissions, logging, retries and edge cases. These things are actually what makes AI systems more reliable. 

Fourth - and this is kind of an extension of the previous point, people give the agent the keys to everything. Full admin priviliges everywhere. Least privilege applies to AI too. I've spent my career advising businesses to stop creating over-permissioned service accounts, only to get to 2026 and see the same happening with robots.

Fifth - they don't actually measure the productivity gains. I honestly think that AI is making many businesses less productive - because they're not using it in the right ways. You can't just judge the efficiency of an AI system on vibes, you need to pick the important metrics (hours saved, response times, customer satisfaction, etc.) and *watch them*!

I'm a bit disappointed that nobody has commented on the new hakluke.com design yet.

I used my bare hands and raw organic intellect to ask Claude to redesign it all by myself.

Some tips on writing a good AI bug validator. Learned this the hard way.