HackerOne Clarifies AI Training Policies Amid Researcher Concerns

HackerOne, a bug bounty platform, recently introduced its Agentic PTaaS, which combines autonomous agent execution with human expertise for continuous security validation. This announcement sparked concerns among researchers about the potential use of their submissions for training AI models. In response to these concerns, CEO Kara Sprague made a public statement clarifying that HackerOne does not use researcher submissions or customer data to train generative AI models, either internally or through third-party providers.

Sprague reassured researchers that their contributions are not inputs for AI models and emphasized that the system, named Hai, is intended to enhance their work rather than replace it. This clarification comes at a time when many researchers are wary of how their data might be utilized, especially in light of the growing integration of AI in cybersecurity.

Other platforms have also addressed similar concerns. For instance, Intigriti’s CEO stated that researchers own their work and that AI is applied to enhance their capabilities. Bugcrowd’s terms and conditions explicitly prohibit third parties from using customer or researcher data for AI training while holding researchers accountable for their use of generative AI tools.

Implications for Researchers and Organizations

The clarification from HackerOne is significant for maintaining trust within the bug bounty community. Researchers rely on the assurance that their submissions are confidential and not repurposed for AI training. This trust is essential for encouraging ongoing participation in bug bounty programs, which are critical for identifying vulnerabilities.

Organizations utilizing platforms like HackerOne must ensure they understand the data usage policies of their vendors. Transparency in how researcher data is handled can mitigate risks related to privacy and confidentiality breaches.

As AI continues to evolve in the cybersecurity landscape, researchers should remain vigilant about how their contributions are utilized. Monitoring platform policies and engaging in discussions about data usage can help researchers protect their interests while contributing to security efforts.