HackerOne CEO: Humans still lead AI on business logic flaws as bug bounty submissions grow 2.8x
In a Help Net Security interview, HackerOne CEO Kara Sprague argues that AI finds familiar vulnerability classes at scale, but humans keep the edge in judging what a flaw means for a business, especially business logic bugs. Citing the 2026 HackerOne Security Research Report, she says 85% of researchers are building AI skills, 68% say AI pushes them toward more complex, higher-paying bugs, and 72% name business logic flaws as their fastest-growing category. Routine, pattern-based medium-severity findings are expected to pay less, while payouts overall rose 26% year over year in H1 2026. Submissions have grown 2.8x since January 2025 against 1.9x for valid reports, and most of the remainder are duplicates, informative, out-of-scope or spam reports; Sprague notes these figures do not show how much of the increase comes from AI. This is industry commentary with no specific incident, vulnerability or threat actor.
Detalhes técnicos
- Programs with AI assets in scope doubled in two years, and valid AI vulnerability reports rose 222%.
- Sprague ranks business logic first among the hardest tasks to automate, followed by chaining vulnerabilities, where models are improving.
- About 70% of security leaders say validated findings reach their backlog faster than teams can fix them. 58% say product delivery or business priorities delay fixes for critical and high-severity bugs.
Remediação
- Programs are responding with submission limits based on researcher track record and private access tiers.
- Programs need faster report triage that combines people and automation.
- Defenders should not leave medium-severity vulnerabilities unfixed, since cheaper AI-driven discovery also helps attackers.
Linha do tempo
-
HackerOne CEO: Humans still lead AI on business logic flaws as bug bounty submissions grow 2.8x
ler a análise desta fonte ocultar
In a Help Net Security interview, HackerOne CEO Kara Sprague argues that AI finds familiar vulnerability classes at scale, but humans keep the edge in judging what a flaw means for a business, especially business logic bugs. Citing the 2026 HackerOne Security Research Report, she says 85% of researchers are building AI skills, 68% say AI pushes them toward more complex, higher-paying bugs, and 72% name business logic flaws as their fastest-growing category. Routine, pattern-based medium-severity findings are expected to pay less, while payouts overall rose 26% year over year in H1 2026. Submissions have grown 2.8x since January 2025 against 1.9x for valid reports, and most of the remainder are duplicates, informative, out-of-scope or spam reports; Sprague notes these figures do not show how much of the increase comes from AI. This is industry commentary with no specific incident, vulnerability or threat actor.
Technical Details
- Programs with AI assets in scope doubled in two years, and valid AI vulnerability reports rose 222%.
- Sprague ranks business logic first among the hardest tasks to automate, followed by chaining vulnerabilities, where models are improving.
- About 70% of security leaders say validated findings reach their backlog faster than teams can fix them. 58% say product delivery or business priorities delay fixes for critical and high-severity bugs.
Remediation
- Programs are responding with submission limits based on researcher track record and private access tiers.
- Programs need faster report triage that combines people and automation.
- Defenders should not leave medium-severity vulnerabilities unfixed, since cheaper AI-driven discovery also helps attackers.