Loading story…
HackerOne has expanded beyond its roots as a bug bounty marketplace and live hacking community into a broader enterprise security platform focused on validation, AI-assisted testing, and Continuous Threat Exposure Management (CTEM). Earlier company messaging highlighted its large global hacker community and events such as live hackathons, but newer reporting says the business is increasingly oriented toward enterprise-scale security operations and automated workflows.
The shift is being driven by both business pressure and the operational impact of AI on vulnerability intake. According to the reporting, HackerOne recorded 46,947 submissions in March 2026, a 76% year-over-year increase, while only about 25% were valid and exploitable; remediation throughput reportedly rose just 19%, pushing backlog to a record high. The same reporting says controversy has emerged around HackerOne's AI terms and data governance, with company documentation indicating researcher and customer data may be processed as inference context in authorized workflows but is not used to train or fine-tune underlying generative models, leaving trust, triage capacity, and researcher compensation as key unresolved issues.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
HackerOne's April 2026 responsible-AI statement said it does not train, fine-tune, or otherwise improve generative AI or large language models using confidential customer or researcher data. It also said approved AI partners including AWS Bedrock and Anthropic must provide zero data retention and must not use inputs or outputs for model training.
HackerOne said submissions reached 46,947 in March 2026, a 76% year-over-year increase. It said roughly one quarter were valid and exploitable, critical and high-severity findings rose to 32% of validated vulnerabilities, remediation throughput increased only 19%, and backlog reached an all-time high.
HackerOne said in 2024 that its pentesting and AI red teaming business had grown 200% over the preceding 12 months, while vulnerability findings and hacker rewards had grown 120%.
HackerOne appointed Kara Sprague as CEO in 2024, succeeding Mårten Mickos.
HackerOne cut about 12% of its workforce in 2023. CEO Mårten Mickos attributed the layoffs to the broader economic environment and changes in customer purchasing behavior.
HackerOne's 2023 customer terms documented a default 20% fee on monetary rewards, marking a defined pricing policy for bounty payouts.
In January 2022, HackerOne announced a $49 million Series E investment and said its total funding had reached nearly $160 million.
By the end of 2019, HackerOne said it had hosted 20 Live Hacking Events in 12 cities, paid more than $7 million in bounties, and received more than 5,000 reports through those events.
HackerOne said its first company-run Live Hacking Event took place in Las Vegas in 2016, reflecting the company's early focus on community-driven bug bounty activity.
HackerOne's current Community Member Terms became effective on May 11, 2026. The article says researchers had raised concerns after changes to HackerOne's terms regarding the use of researcher submissions and AI.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HackerOne has reported a significant increase in bug bounty payouts, distributing $81 million to ethical hackers worldwide over the past 12 months, marking a 13% year-over-year growth. The platform, which manages over 1,950 bug bounty programs for major organizations such as Anthropic, Crypto.com, General Motors, GitHub, Goldman Sachs, Uber, and the U.S. Department of Defense, has seen its top 100 programs alone pay out $51 million between July 2024 and June 2025. The average annual payout per active program reached nearly $42,000, with the top 10 programs accounting for $21.6 million. Individual researchers are now consistently earning six-figure sums, and the top 100 all-time earners collectively received $31.8 million. A notable trend in the past year has been the dramatic rise in AI-related vulnerabilities, with prompt injection flaws increasing by 540% and overall AI security issues rising by more than 200%. This surge is attributed to both the expansion of enterprise AI security initiatives—growing at nearly three times last year's pace—and the emergence of 'bionic hackers' who leverage AI tools to enhance vulnerability discovery. In 2025, 1,121 bug bounty programs on HackerOne included AI in their scope, representing a 270% year-over-year increase, and autonomous AI-powered agents submitted over 560 valid reports. While traditional vulnerabilities such as cross-site scripting (XSS) and SQL injection (SQLi) have declined, authorization-related flaws, including insecure direct object reference (IDOR) and improper access control, are on the rise. HackerOne's CEO, Kara Sprague, highlighted the unprecedented scale at which security issues are being discovered due to the integration of AI in both offensive and defensive security practices. The company also noted that 70% of surveyed researchers have incorporated AI tools into their workflows, further accelerating the identification of vulnerabilities. The data underscores a shift in the threat landscape, with AI security becoming a primary concern for organizations participating in bug bounty programs. The increased payouts reflect both the growing complexity of vulnerabilities and the value organizations place on proactive security research. HackerOne's annual report serves as a barometer for industry trends, indicating that as AI adoption accelerates, so too does the need for robust security measures and incentives for ethical hackers. The platform's continued growth and the rising sophistication of its researcher community suggest that bug bounty programs will remain a critical component of organizational security strategies. The findings also emphasize the importance of adapting vulnerability management processes to address emerging threats, particularly those associated with AI technologies. As enterprises expand their AI initiatives, the collaboration between organizations and the ethical hacking community is proving essential in mitigating evolving risks. The report concludes that the intersection of AI and cybersecurity will continue to shape the future of vulnerability discovery and remediation.
Jul 12, 2026
Security teams are struggling to keep pace as AI accelerates vulnerability discovery, bug bounty submissions, and pentest findings faster than organizations can validate and remediate them. Microsoft said it paid more than **$20 million** to **562 researchers** for **2,531** eligible reports across 15 bug bounty programs, attributing a surge in submissions in part to AI-assisted research, while Cloudflare said it now uses Anthropic’s Claude Sonnet to triage bug bounty reports, filtering duplicates and routing only higher-value submissions for human review. Survey data from Pentest-Tools.com similarly found that AI-generated findings are creating large validation backlogs, with practitioners citing false positives, duplicate reports, unexploitable issues, and even fabricated CVEs as persistent problems. The operational gap is widening as attackers move faster than defenders can patch. Dataminr reported a median patch time of **43 days** versus an average attacker breakout time of **29 minutes**, and ZDNET described an ecosystem-wide surge in flaws across major vendors and open source projects, including high-volume bug discovery in Chrome, Apple platforms, and the Linux kernel. Open-source maintainers are also tightening disclosure processes under strain: GNOME reduced its disclosure deadline from **90 days** to **30 days** for new reports and said it would stop forwarding reports to projects that ban AI-generated content. Across the industry, the trend is pushing CISOs toward exploitability-based prioritization, stronger triage workflows, and selective automation rather than relying on raw finding volume alone.
Aug 5, 2026
Security commentary highlighted how **generative and agentic AI** can accelerate attacker reconnaissance and highly tailored social engineering, while also creating defensive opportunities such as deploying AI-generated “decoy employees” (fake social profiles, CVs, and inboxes) to attract malicious profiling and phishing attempts and convert them into threat intelligence (e.g., identifying suspicious IPs/URLs and credential-stuffing activity). The same theme emphasized that AI’s impact is not purely additive for adversaries; defenders can use automation and deception to expose attacker infrastructure and tactics. HackerOne faced public backlash from researchers who questioned whether bug bounty submissions and customer data were being used to train its new **agentic pentesting** offering (*Agentic PTaaS*) and its AI system (**Hai**). In response, CEO Kara Sprague stated that HackerOne **does not train generative AI models**—internally or via third parties—on researcher submissions or customer confidential data, and that third-party model providers are not permitted to retain or use such data for their own training; she positioned Hai as augmenting researchers by accelerating validation, fixes, and rewards rather than replacing them. A separate ZDNET piece was largely executive-level thought leadership on generative AI and critical thinking and did not add incident-level or technical security detail to the policy controversy.
Jun 29, 2026