Hackbots — Jason Haddix’s $1,000 agent course, all 9 hours, free
The 2026 course on building offensive AI agents. On demand, intermediate, released this year.
Who teaches it — Jason Haddix: CEO of Arcanum, twenty years in offensive security, formerly CISO at Ubisoft, Head of Trust & Security at Bugcrowd, Director of Penetration Testing at HP, and author of The Bug Hunter’s Methodology. His own bio says it better than I can.
├─ hack bots built on Claude Code, Codex and agent frameworks
├─ automated recon, asset discovery, API testing, JavaScript analysis
├─ bug bounty workflows, vulnerability triage, XSS and SSRF
├─ multi-agent workflows, prompt engineering, blue team bots
└─ human-in-the-loop by design, not vibes
The official syllabus, so you know what you are getting — Arcanum
Inside the archive are the lesson videos; play those and skip anything that asks to be installed. The course is what it says on the page: nine hours of a practitioner building hack bots in front of you.
Nice share, thanks for putting this up. I have been running agents against a small local lab target before letting them touch anything bigger, and that habit has saved me a few headaches. Keeping a human review step in the loop matters a lot, since the agent output is really a draft that needs manual verification before you trust any finding. One practical note that helped me: give the agent a narrow scope in its system prompt, like one host and one testing goal, so it does not wander off into unrelated actions. Once the basics feel boring, that is when the real learning starts.
Thanks for sharing this, the syllabus breakdown is really useful. The human-in-the-loop part stood out to me too, that feels like the bit most people would skip and then regret. Appreciate you laying out what is actually inside the course.