Founding Security Researcher @blackthornxyz | Lead Senior Watson @sherlockdefi | Ai alt: @pkqs91

Joined January 2021
Built @sunyuchentron 's story into an AI galgame lmao. tldr, just trust claude for financial advice.
赚不到孙哥的钱,但可以过一遍孙哥的人生。 如果你是孙哥,会为了景甜去北京吗? 《我的女友景甜》游戏版,免费玩:dramori.ai/stories/my-girlfr…
1
7
1,711
Probably most SRs are doing this already, but I still wanted to share what I learned from hunting on bug bounties with AI since the beginning of this year. Title is clickbait :)
15
16
289
23,499
vibe coded a LOT the past few weeks and here is a trick I want to share
I've been using @mattpocockuk skills for the past couple of weeks, and my productivity has probably 3x'd. My usual work session starts with the /grill-me skill. Begin with a broad, messy task, and the agent keeps asking questions until the gaps are clear. The useful part is that while you're answering, you're also forced to understand the task better and dig into the details you skipped. One time it grilled me for 80+ questions and halfway through I was basically asking are we there yet every few minutes. Then I run /to-issues skill and kick the issues off in goal mode. One detail I think is very important is to explicitly ask it to spawn subagents for each task, test the work when it's finished, and redo it if it's not actually done. Runs usually go for multiple hours, so once one is kicked off, I can start working on another session, or just go back to doomscrolling.
1
36
4,502
pkqs90 retweeted
$32,000 paid out. Two high-severity bugs. One Warden. Huge shoutout to @pkqs90 for back-to-back high-severity findings in the @succinctlabs and @gmtrade_xyz bug bounties on Code4rena! Here's a look at those payouts!🧵👇
6
4
1
127
4,832
pkqs90 retweeted
Congratulations to security researcher @pkqs90! $49,000 for a blockchain/dlt crit. Well done, sir! Pledge IMU to pkqs here and earn when they find bugs: immunefi.com/pledge/pkqs90/
15
11
3
309
12,132
You know a model is NERFED when working a defi codebase and it replies 液化 (liquify) for liquidation
4
32
2,445
Bagged 4 crits in the last 2 months on @immunefi. 2.5k, 5k, 10k, 50k, the last one should’ve been 100k, but it is what it is. Payouts are def worse nowadays compared to the bull market, but overall still pretty happy with the hunt so far.
19
7
247
6,124
Very solid codebase for @flyingtulip_ 🫡
Here are the results of the @flyingtulip_ Audit Contest! 1. @pkqs90 - $23,518 🥇 2. @taridoku - $4,478 🥈 3. @demorextess - $4,363 🥉 $100,000 in rewards, bringing Sherlock's total researcher payouts to $20.1M+. Link below for the full results 👇
1
1
49
3,304
Prediction: By the end of 2026, the leading individuals in Web3 security won't be differentiated by critical thinking and hard work alone. It'll also come down to an AI-native auditing workflow. If you're not running AI intensively in your regular audit process, you'll fall behind, fast.
12
70
5,826
pkqs90 retweeted
💡AI's Transformative Impact on Web3 Security: Predictions from Late 2026 Onwards💡 From late 2026 onwards what was once a domain dominated by human auditors poring over code will evolve into a hybrid ecosystem where AI amplifies human expertise, reduces costs, and reshapes incentives. 1⃣ Lowering Total Cost of Securing a Protocol One of the most tangible impacts of AI will be a reduction in the overall cost of securing web3 protocols. Today in early 2026 we're already seeing specialist AI agents detecting a broad spectrum of vulnerabilities. Foundational models continue to improve in reasoning and skilled researchers are layering on custom heuristics, creating specialist AIs that can find valuable bugs "at scale". External audits which can easily run into six figures for a comprehensive review have long been a pain point for protocols. If an initial audit uncovers too many findings protocols often face costly re-audits, delaying launches and inflating budgets. By late 2026 specialist "PR Review" agents will be commonly used during development to catch bugs early - and some specialist AI products can catch an impressive range of bugs today; this will only improve by late 2026 & onwards. AI will also supercharge testing methodologies, making it much easier and cost-effective for developers to commonly deliver hardened codebases featuring invariant testing and formal verification. The net effect? Protocols will require fewer external audits, lowering the total cost of securing a protocol. 2⃣ The Evolving Role of Human Auditors Human auditors won't disappear; instead, their work will pivot toward higher-value activities. By late 2026, a growing number of auditors will shift from manual code reviews to developing and refining heuristics for specialist AIs. The trend of auditors consolidating into larger firms will continue; expectations for efficiency will increase across the board. The best auditors will leverage AI to become super-human, highly-efficient bug-finding machines. 3⃣ Capped Auditor Remuneration in Maturing Market The web3 security space is maturing rapidly. In the Wild West days of 2021-2024, sky-high fees and long waiting times were justified by rampant hacks and scarce expertise. But as many skilled auditors transition into creating heuristics for Specialist AI auditors vastly improving their vulnerability detection, clients will increasingly prioritize speed & value. Market share will gravitate toward quality brands that consistently deliver great security output at an efficient price point, who provide great value for money. Intermediate-Senior human auditors will still be able to make a good living but the extremely expensive ones may struggle to remain consistently booked, a trend which played out especially through the first half of 2025 and will accelerate in the future. New & Junior auditors will struggle as the bar to achieving professional success will be raised higher & there will be more competition than ever; they will be completely replaced by Specialist AIs who will consistently perform better providing more value than them. 4⃣ Shorter Exploit Windows and the Elimination of Common Bugs AI's double-edged sword will manifest in exploit dynamics. On the dark side, blackhat AIs will exploit vulnerabilities faster than ever. A protocol launching with bugs in late 2026 could be drained in hours, not days, as blackhat AIs trawl the blockchain in real-time. Conversely, mass adoption of specialist AIs by developers will nearly eliminate certain bug classes. Reentrancy, integer overflows, incorrect rounding direction and access control flaws could become relics, caught routinely during the development process and not even making it to external audits let alone to live deployment. 5⃣ Human-AI Symbiosis Here's the key: Specialist AIs won't stay effective without human input. Auditors and researchers must continually update them with the latest heuristics, drawing from private/competitive audits, post-mortems of hacks and other threat data. This creates a virtuous cycle—humans teach AIs, AIs protect protocols, and the ecosystem grows more resilient providing increasingly efficient security "at scale". In summary, from late 2026 onwards, AI won't replace web3 security professionals but will redefine the field as a collaborative powerhouse. Roles will evolve & markets will mature - for devs, auditors, and protocols: Embrace AI now, or risk being left behind.
13
5
68
4,611
The moment you’re reading some confusing code and this close to cursing… then you realize it’s probably 99% AI generated
1
26
1,634
Haven’t done a design review in years. Can't believe now I’m presenting my design to gpt and watching it tell me it's trash 😅
12
1,265
Stats for 2025: - Completed 20+ audits with @sherlockdefi / @blackthornxyz - Won 2/4 contests I competed in - Grabbed 3 H/M bounties
2
73
3,044
Fun facts: - Teamed up with @thekmj_ earlier this year and together we achieved our worst contest result ever: last place with a solid 0 findings 💀
5
29
1,577
2026 wish: Never stop learning. Happy New Year 🎉
13
1,254