HackerOne under fire for AI data practices and corporate pivot

HackerOne is facing intense scrutiny from its security research community following a detailed account of the platform’s strategic decline. A blog post by a former bug bounty program manager, who oversaw operations from 2018 to 2025, outlines a shift from a hacker-first model to a sales-driven enterprise under venture capital pressure. The author argues that the company has stagnated in product innovation while prioritising annual contracts and multi-year deals to satisfy investors.

The controversy centres on the use of researcher data for artificial intelligence. In February 2026, updates to the Terms of Service suggested that submissions could be used to train AI models, prompting immediate backlash. Co-founders Alex Rice and Michiel Prins issued statements denying that researcher data was used to train generative AI or large language models. Rice appeared on the Critical Thinking Bug Bounty Podcast to address concerns, while CEO Kara Sprague posted on LinkedIn that submissions were not used for training or fine-tuning.

However, internal communications revealed a more complex reality. HackerOne’s AI agent, Hai, was found to be using report outcomes to influence future automated triage decisions. Product managers confirmed that the system learns from behaviour, storing rejection reasons to augment reasoning for new reports. While the company maintains this is distinct from training a model, critics argue the distinction is semantic, as past reports directly alter future automated behaviour.

Leadership changes have further alienated the user base. Marten Mickos, who served as CEO for nearly a decade, was replaced in late 2024 by Kara Sprague, former Chief Product Officer at F5. The author notes that the company has rebranded around Continuous Threat Exposure Management and launched agentic testing products, moving away from its origins as a safe space for ethical hackers. The introduction of the Hacker Success Program created a two-tier system, offering direct support to top hackers while leaving new researchers with limited advocacy channels.

Community trust has eroded further with recent product launches. In June 2026, HackerOne released HackerOne Continuous Testing, with initial marketing copy stating it used context from 12 years of real-world vulnerability data. The company later walked back these claims, with co-founders clarifying that the agents use contextual feedback to map attack surfaces rather than deploying techniques from researcher submissions. Despite these explanations, the author concludes that the platform’s core identity has been lost to corporate objectives.