Table of contents
21
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member)
Read this in 30 seconds: No bug bounty platform bans AI, and every major one will still remove you for what AI makes easy: reports you did not verify. The rules are spread across codes of conduct, program briefs and blog posts, and most programs say nothing at all.
- Zero of 53 policies ban AI. Stingrai’s census of 53 published bug bounty and disclosure policies, collected on 28 July 2026, found 36 silent and only 16 with any AI clause. All four platforms (HackerOne, Bugcrowd, Intigriti, YesWeHack) have one.
- Every AI bug bounty policy says “you verified it”, not “no AI”. HackerOne, Intigriti and YesWeHack each hold you responsible for validity, and Bugcrowd reviews accounts after 10 consecutive invalid reports and can suspend them for 30 days.
- Only a few AI bug bounty policy pages ask you to disclose. Intigriti, Django and FFmpeg do, and FFmpeg asks for the name of the human who verified the report instead.
- The line is autonomy. HackerOne says AI tools may not operate fully autonomously and requires a human to validate every finding before submission. Wireshark accepts AI-written reports but refuses agent-submitted ones.
- The money moved faster than the rules. curl ended its bounty on 31 January 2026, and GitHub added a HackerOne signal requirement on 22 July 2026 with four initial submissions for newcomers.
You can use AI on every part of a hunt and still get banned, and the AI bug bounty policy pages that decide which side you land on are scattered across a code of conduct, a program brief and a blog post. Most of them are also quiet. Two out of three programs in the largest census I could find say nothing about AI, which sounds like freedom until a triager closes your report under a rule that was never on the page.
This guide collects what each platform’s AI bug bounty policy and a set of well-known programs actually require, using their own published text, so you can stay on the right side of every one of them with the same set of habits. I read the platform rules and program pages directly on 5 November 2026, and I say where I relied on a secondary source. I am not a lawyer, and a policy can change tomorrow, so check the page for your program before you submit.
Every AI bug bounty policy that exists says the same three things: AI is fine, you must verify, and you own the result. Stingrai coded the 16 policies that mention AI. Thirteen require the reporter to personally verify the finding, 11 make acceptance depend on a working reproduction or proof of concept, and 8 refuse fully autonomous or purely AI-written submissions while allowing AI assistance. Eleven state a penalty.
Read any AI bug bounty policy as a checklist rather than a legal analysis. AI bug bounty policy wording differs in how loudly it says it and what they do to you when you break it, but the behaviour they punish is the same: submitting something you could not reproduce, could not explain, or did not write with understanding.
Two details about any AI bug bounty policy are easy to miss. First, silence is not permission. Stingrai notes that a program with no AI rule may still be bound by its hosting platform’s code of conduct, and all four platforms have one. Second, three programs publish their AI rule somewhere other than the page a reporter is sent to, so a quick read of the brief can miss it.
HackerOne, Bugcrowd, Intigriti and YesWeHack all allow AI, and they differ most on penalties and on disclosure.
| HackerOne | Bugcrowd | Intigriti | YesWeHack | |
|---|---|---|---|---|
| Where the rule lives | Code of Conduct, “AI-assisted Research & Submission Standards” | Policy post by Trey Ford, 10 March 2026 | Community Code of Conduct, “The use of AI”, 9 March 2026 | Platform Code of Conduct |
| AI allowed? | Permitted and encouraged | “Expected and encouraged” | Permitted and encouraged | Not banned; unverified output is |
| Disclose AI use? | Not required by the Code of Conduct | Not stated | Yes: when and how | Not stated |
| Your duty | Fully responsible; validate and prove impact | The human is responsible for accuracy | Personally verify; fully responsible for validity | Findings must be validated and manually tested |
| What happens | Report closed as N/A; escalating conduct enforcement | Review after 10 consecutive invalid reports; possible 30-day suspension | Closed without response; slower validation; possible removal | Violation counts against a seven-point ethical score |
HackerOne’s Code of Conduct permits and encourages AI “for learning, reconnaissance, vulnerability discovery, proof-of-concept development, and report quality improvement”, and then closes the loophole in the next sentence: members remain fully responsible, and using AI does not change the duty to validate findings and provide a reproducible proof of concept.
It lists what gets a report closed as not applicable: speculative or misleading claims, a missing proof of concept, no reproduction, a video as the only evidence, or no demonstrated impact. It also says a repeated pattern of inflated severity is itself a conduct violation, which is the line most AI-assisted hunters trip over, because models love to round up.
The enforcement table lists “large-scale submission of low-quality or unverified vulnerability reports, including misuse of AI tools and automation”, and escalates from a final warning to a 12-month temporary ban to a permanent ban. For agents, HackerOne is explicit: AI tools are not allowed to operate fully autonomously, and its hacker-in-the-loop model requires human experts to investigate, validate and confirm potential vulnerabilities before anything is submitted. Operators are responsible for their tools and must respect each program’s limits on automation, request volume and rate.
Bugcrowd’s 10 March 2026 post is the most specific AI bug bounty policy on thresholds. Accounts that submit 10 or more consecutive invalid reports are reviewed, and if the submissions look automated or AI-generated without validation, the account can get a 30-day suspension. Accounts with 10 or more invalid reports must complete identity verification. Submission farming is a permanent ban, and using automation to squat common findings at program launches without demonstrated impact breaches its standards.
The same post says experimentation with AI is “expected and encouraged”, states that the researcher is responsible for accuracy, and reports that its queues grew by more than 334% in three weeks. It sets no rule on disclosing AI use.
Intigriti’s Community Code of Conduct, dated 9 March 2026, is the most direct. If you use AI you must personally identify and verify the vulnerability, make sure you can stand behind every technical detail, avoid invented endpoints and placeholder text, and “be open and transparent” about AI use by disclosing when and how it was used. Reports that look like unverified AI output, contain fabricated elements or show a lack of understanding may be closed without response, take longer to validate, and “could lead to removal from the platform”.
Its sanctions ladder runs from a warning through invitation restrictions and payment restrictions to platform restrictions, which can be temporary or permanent. Its separate report-writing guide, published in February 2026 and updated on 15 October 2026, adds advice rather than rules: validate the proof of concept in the intended configuration, keep reports concise, and reply to triager questions yourself.
YesWeHack’s Platform Code of Conduct has a violation category called “Program spamming and AI Slop”. It covers reports of poor quality that were not expertly validated and manually tested by the researcher, and reports built on assumptions or AI-generated hypotheses without manual verification. Each researcher holds seven ethical points, confirmed violations deduct points, and the consequences can include removal from programs and a permanent ban. I could not read the exact point deduction for this category from the table, so check it before you rely on a number.
A handful of programs write an AI bug bounty policy stricter than their platform’s, and their wording is the clearest guide to what triagers actually dislike.
Stingrai’s census adds more from its own coding of other programs, which I did not verify on each program’s page: Google applies a 0.8x reward multiplier to AI slop, Wireshark allows AI-generated reports but refuses agent-submitted ones, llama.cpp accepts AI only in an assistive role and requires a working proof of concept, the Linux kernel requires a tested reproducer and treats AI-assisted bugs as already public, and Nextcloud suspended paid bounties and closes low-effort AI reports as spam with a reputation deduction. Treat those as leads to check, not as quotes.
Disclose when the policy asks, and consider doing it when it does not, because a one-line disclosure costs you nothing and its absence can cost you the report.
Required by an AI bug bounty policy today: Intigriti asks for when and how, Django for which tools and for what, and FFmpeg for the name of the human who verified the report. Everywhere else the rule is silent, which means the decision is yours. My view, which is a judgment and not a policy: if AI wrote any part of the text or found any part of the bug, say so in one line and say what you personally checked. Triagers already suspect it. A short statement turns suspicion into a documented, accountable process, and it is the same shape Django and FFmpeg prescribe.
A disclosure that fits all three styles:
AI assistance: I used [tool] to [map the attack surface / draft the description].
Verification: I reproduced this myself on [date] against [target, version]
using [account A and account B]. Steps 1 to 6 below are what I ran, and the
impact section describes only what I observed.
Verified by: [your name or handle]The second and third lines do the real work. They are also the lines that a reviewer under the FFmpeg-style rule would want to see.
Eight checks cover every AI bug bounty policy above, and each one maps to a sentence a program has published.
| Check | Why, and where it comes from |
|---|---|
| Reproduce it yourself from a clean state | HackerOne, Intigriti and Django require personal verification |
| Prove it in the intended configuration | Intigriti’s guide warns a working PoC is not always a valid one |
| Show impact you observed, not impact you imagine | HackerOne closes reports lacking demonstrated impact |
| Set severity honestly | HackerOne treats repeated inflated severity as a violation |
| Delete invented details | Intigriti and Django bar made-up endpoints, placeholders and non-existent features |
| Keep it short | Apple and curl both ask you to avoid long AI-written descriptions |
| Respect automation and rate limits | HackerOne and Intigriti require staying within each program’s limits |
| Answer the triager in your own words | Intigriti’s guide says to follow up without an LLM |
Run the list before every submission, not only the first. The failure mode for experienced hunters is a good record followed by one lazy report that a model made look finished.
The programs that reacted hardest did not write a stricter AI rule; they changed who gets paid and how. Stingrai’s own reading is that curl removed the money, Nextcloud suspended it and Google raised the evidence bar.
The pattern in each AI bug bounty policy shows up across the dated posts. curl stopped paying on 31 January 2026 after its confirmed-vulnerability rate fell below 5%, and Stenberg says it had been north of 15% in earlier years. GitHub keeps paying but gates the public program behind a HackerOne signal threshold, and Apple pauses accounts. The Internet Bug Bounty paused submissions in March 2026, according to Stingrai, which says the stated reason was remediation capacity rather than report quality. I could not open the Internet Bug Bounty’s own page to confirm that.
The practical effect for you is reputation. A bad report now costs more than one closed ticket, because signal, invitation eligibility and payment rights all depend on your record. Our guide to what the data says about AI and winning bug bounties covers the economics, and the bug bounty report writing guide covers structure.
If a program has no AI bug bounty policy, apply the strictest rule you can find from its platform, then add a disclosure line. Three steps:
Autonomous agents are where the policies bite hardest, so the setup matters. HackerOne requires a human to investigate, validate and confirm every finding before submission, Wireshark refuses agent-submitted reports, and most platforms cap request volume. That leaves a workable pattern: let the agent do recon and discovery, stop at each candidate finding, verify by hand, and only then draft.
Short and biased, since it is our product. The XHack AI agent is built around the verify-first pattern that every AI bug bounty policy asks for. You hand it the program scope and rules of engagement through the chat, it remembers them, and our bug bounty guide tells you to repeat any rate limits explicitly, because the agent can run up to 12 sub-agents by default and a program’s request limits are yours to enforce. The agent can draft a report once you have confirmed a finding. The confirming, the severity and the submission stay yours, which is exactly what every policy above asks.
Agent chats are not stored or accessible by XHack, so keep your own log of what you ran and what you saw.
That log is the best evidence you have if a triager asks how you found something. Plans are $20, $49 and $150 a month, with a 7-day free trial that is one per person, and exploitation features unlock once your identity is verified. See pricing. When is another route better? If you hunt by hand and only use a chatbot to polish writing, you do not need us, and the checklist above is all you need. Prefer to talk it through first? Book a free consultation, even if that turns out not to be us. Brutal honesty is kind of our thing.
No. Stingrai’s census of 53 policies, collected on 28 July 2026, found zero outright bans, 36 silent policies and 16 with an AI clause. HackerOne, Bugcrowd, Intigriti and YesWeHack all allow AI and all hold you responsible for what you submit. What they punish is unverified, fabricated or speculative output, whoever or whatever wrote it.
Only some programs require it. Intigriti’s Code of Conduct requires you to disclose when and how AI was used, Django requires you to name the tools and what they did, and FFmpeg asks for the name of the verifying human. HackerOne and Bugcrowd do not require disclosure in the pages I read. Disclosing in one line is a sensible default where the policy is silent.
It depends on the platform. HackerOne closes it as not applicable and escalates repeated or large-scale cases from a final warning to a 12-month ban to a permanent ban. Bugcrowd reviews accounts after 10 consecutive invalid reports and can suspend for 30 days. Intigriti can close without response or remove you, and Apple can pause your reports for 180 days.
You can use it for discovery, but a human must validate before submission on HackerOne, which says AI tools are not allowed to operate fully autonomously. Wireshark refuses agent-submitted reports, and most programs limit automation and request volume. Keep a person between the agent and the submit button, and tell the agent each program’s rate limits.
HackerOne’s Hai documentation says Hai does not train, fine-tune or otherwise improve generative AI or large language models on customer or researcher data. It does not say whether report content feeds other machine-learning triage models, and it says rejecting a Hai recommendation helps improve its accuracy. Check the current terms of any platform you use.
Yes, if you validated it. Apple lists issues discovered by AI without proper validation as ineligible, and HackerOne says human operators using hackbots qualify for rewards as if they had found the bug themselves. Under every AI bug bounty policy the consistent line is that a person confirmed it with a working proof of concept and real impact.
Nobody is banning AI from bug bounties, and everybody is banning the thing that AI makes cheap: finished-looking reports nobody verified. Verify it yourself, prove the impact you saw, keep it short, put your name on it, and add a one-line disclosure where the policy asks or stays silent. Do that and an AI bug bounty policy stops being a trap, and your record does the work the rules cannot.
Categories
Related articles
