Bugcrowd AI Strategy Prompts Questions Over Whether Bug-Bounty Reports Feed AI Agents
Security researchers raised questions about Bugcrowd's new AI strategy, saying its description of connecting report "signals" suggested bug-bounty submissions and researchers' thought processes could feed AI agents that later identify vulnerabilities with less human input. The criticism centered on whether submitted reports are being used to train those systems and what incentives contributors would have if automation built on their work reduces the need for manual testing.
The concerns followed a similar debate weeks earlier after HackerOne referenced using AI agents for testing based on researcher reports. The comments did not establish that Bugcrowd is training on submitted reports, but highlighted broader demands for transparency from bug-bounty platforms as they add AI tools.
From the sources (3 posts)
@infosec_auso the bug bounty community freaked out a few weeks ago when hackerone had a single slide that talked about using AI agents for testing based off our reports. bugcrowd's new strategy sounds even more brazen, sly and
@rez0__RT @infosec_au: so the bug bounty community freaked out a few weeks ago when hackerone had a single slide that tal…
@zseanoRT @infosec_au: so the bug bounty community freaked out a few weeks ago when hackerone had a single slide that tal…