Reszo Joseph and XSS Doctor discuss their Singularity hackbot on the Critical Thinking Bug Bounty Podcast. They say it found a blind MongoDB `$where` JavaScript issue behind a GraphQL-looking API and a crackable OTP hash in a Google product. They also describe Discord control, boss and worker agents, validator and escalation steps, false positives, scope drift, and auth as the hard part.