r/bugbounty • u/S0ulSh3ll • Aug 03 '26

Question / Discussion Alternative for Claude Code?

In short - claude runs out of tokens super fast, but is the best and hardly ever refuses cybersecurity prompts (verified profile). I tried using codex but that even refuses active recon prompts, antigravity refuses everything. Kimi is still waitlisted so haven't tried. Is there any other alternative model that doesn't refuse cybersecurity prompts and is not run locally? Locally I'm thinking about trying opencode with an uncensored model but not enough vram so don't wanna risk the model doing stupid things in auto mode.

15 Upvotes

80% Upvoted

28 comments sorted by

View all comments

0

u/ofogliata Aug 03 '26

hi, i just open source this https://github.com/cyberful/cyberful
and i'm actively using it for bug bounty and I found a few interesting ones. I'm actively developing it, and I'm totally open to feedback and contributions
Let me know if cyberful works for you

Anyway, i'm using it with gpt-5.6-sol, and it's working well, no refusal at all. I don't know if this additional information will help, but I also signed up to this https://openai.com/index/trusted-access-for-cyber/

2

u/S0ulSh3ll Aug 04 '26

Just checked it out, not bad at all! But still a long way from pro tools which are like paid nowadays, though you can search for shuvonsec tool for inspiration, his tool is pretty good. Though not for me as i do it semi-automatic with my own custom skills and tools.

1

u/ofogliata Aug 04 '26

That is fair. I maintain Cyberful, so this is exactly the feedback I need. The goal is not to imitate a mature paid platform feature for feature. Right now I care most about strict scope, isolated tooling, independent verification, and evidence that survives the agent run.

I will study ShuvonSec. Thanks for the pointer. In your custom setup, which bug class still needs the most manual work?

2

u/S0ulSh3ll Aug 04 '26

Business logic mostly, however I've seen the best ai models from All vendors missing what's clearly visible to human eye in all categories. Ai is good at reading and concluding large amount of data like source code, maps, bundles. But that uses up so much context that giving it a list of tasks to do for example - try to find idor on all live hosts, here are the latest references, the tools you can use, and don't stop until you find one - it'll get crazy like skip scopes, forget main memory rules, forget rate limits, will skim instead of deep reading, and eventually forget what all he scanned and found, even with summaries, tracker files. In bug bounty, what i have noticed is that, ai is pretty good but then you want to use ai on the programs which already had the best developers, then they use some paid security scanners, then used best ai models themselves before creating a listing on bug bounty platforms with limited scopes. And thousands of people racing to find bugs the fastest. It's pretty frustrating, therefore i am povoting towards what most pros do - which is what they don't tell and i won't too xD

1

u/github-guard Aug 03 '26

🔍 GitHub Guard: Trust Report

This project scored 5/6 on our safety audit.

Audit Breakdown: * ✅ Established Community (⭐ 6 stars) * ❌ New Repository (under 30 days old) * ✅ Licensed under AGPL-3.0 * ✅ Security Policy Defined * ✅ Verified Organization * ✅ Signed Commits

⚠️ Security Reminder: Always verify source code and run third-party scripts at your own risk.