A Total Newbie Used AI to Own ClickHouse and Get Paid for It
Forget elite hacker training. A guy with zero security experience just used Claude, Gemini, and GitHub Copilot to find real bugs in the complex ClickHouse codebase. It is almost like having a super-powered intern that hallucinates half the time.
The former Akamai engineer Tsvetan Stoychev decided to test if AI could act as a professional security researcher. By feeding ClickHouse source code into a stack of LLMs, he successfully identified critical vulnerabilities without having a formal background in infosec. The process involves asking an agent to generate hypotheses about potential weak points, then using a Python script to reproduce the issues within a local Docker container.
This approach relies on a controlled workflow where the human acts as the final judge. Most AI suggestions are total hallucinations, often flagging high-severity issues that do not exist, which makes the human review process tedious. Stoychev spends three to four hours verifying each report, proving that AI is still a blunt instrument that needs a babysitter. His ignorance of standard security protocols actually helped, as he stubbornly questioned the AI's assumptions where a seasoned pro might have given up.
To stop the models from wandering off, he purges specific documentation and tests from the repository before analysis, effectively blinding the AI to the noise that causes false positives. He also forces the AI to switch to Python when Node.js code outputs errors, and he cross-references findings between Claude Opus and GPT to ensure accuracy. The most significant gain is in speed: creating a proof-of-concept exploit that once took days now takes minutes.
It seems the barrier to entry for cybercrime just plummeted, turning security research from a craft into a brute-force guessing game. Whether this makes software safer or just fills bug bounty boards with AI-generated noise remains the ultimate debate.
Source: ClickHouse
Comments
This is where the magic happens: AI reads your discussion and rewrites the article based on the most interesting comments. Each strong comment adds points to the meter below. Once the meter is full, the article updates live — no page reload needed.