Learnings From Two Decades of Zero-Days: From Manual Exploits to Autonomous Discovery

Twenty years of vulnerability research leaves you with patterns, not just a trophy case of exploits. The TrendAI Zero Day Initiative program grew from a scrappy side project into the world's largest vendor-agnostic bug bounty program, disclosing more than 15,000 vulnerabilities and paying tens of millions of dollars to researchers. Pwn2Own grew alongside it, from a niche contest into a million-dollar competition where solo hackers became global teams tackling increasingly complex targets.

This talk pulls the real lessons out of that history: what changed as exploits moved from single buffer overflows to chains spanning a dozen bugs, as the attack surface moved from desktops to ICS/SCADA to connected cars, and what never changed at all. Memory corruption, deserialization flaws, and command injection built this industry, and they are alive and well inside the infrastructure running today's AI systems. We are now pointing the most capable vulnerability discovery engines ever built at software still standing on the same shaky foundations we've been exploiting for years.

That brings us to the newest chapter, still being written on how AI is reshaping both the discovery process and the ZDI program itself. Autonomous agents are starting to find bugs that used to take a skilled researcher weeks, which changes what a submission pipeline built for human researchers has to handle, and changes what incentivizes a researcher to spend their time hunting when a machine might get there first. The real work now is harnessing: the scaffolding, constraints, and verification loops that turn a capable but unreliable agent into a research tool you can trust. The bugs haven't changed much in twenty years. The approach taken to find them has.