HackerOne clarifies AI training stance amid researcher concerns

HackerOne has addressed concerns from security researchers regarding the use of their submissions to train artificial intelligence models. The company clarified its position following the launch of its Agentic PTaaS, which combines autonomous agents with human expertise, as reported by The Register.

The controversy began when researchers questioned if their bug bounty submissions were being used to train HackerOne's AI agents. HackerOne CEO Kara Sprague stated unequivocally that the company does not train generative AI models on researcher submissions or confidential customer data, either internally or through third parties. She emphasized that their AI system, Hai, is designed to accelerate outcomes like validated reports and rewards, not to replace researchers.

Other platforms like Intigriti and Bugcrowd have also affirmed their policies against using researcher data for AI model training, while also holding researchers accountable for their use of AI tools and ensuring automated outputs meet submission standards.

Source: The Register