Ten years of HackerOne Security Research Reports. This one has the biggest number yet.

Researchers earned $89 million through HackerOne bug bounty programs last year, an 18% increase from the year before.

The attack surface is growing. So is the opportunity.

Read on for the vB870Dkwu

What vulns are AI tools weakest at finding?

In the latest HackerOne Security Research Report, 62% of researchers said it was business logic, and 41% said multi-chain exploits.

In the latest episode of Exposed, however, Douglas (archangel) says that as models become more hers get better at prompting, the gaps are going to get smaller.

Fixed, or already exploited? Redis is building a bug bounty program that answers both.

The result: a much bigger program, with the same team.

Learn how Justin Lachesky at Redis right-sized scope, centralized intake, and put researcher findings to work: bit.ly/4eHHZm7

In the latest Episode of Exposed, Luke asks Douglas (archangel) what automation still misses.

“Having context on the application—there are certain vulnerabilities that might not be a big deal for most programs, but might be very impactful for another. Being able to tell your nd an application, and what would hurt the program the most, is key to delivering impact.”

Researcher Douglas Day (archangel) has had his best bounty year yet, running a custom AI pipeline that files valid bugs while he sleeps. In the latest episode of HackerOne’s Exposed video series, Douglas shares his approach.

Agent hacking isn’t as simple as just pointing Claude e. Without training AI, you’re not going to see results from using it.

Douglas explains that although he uses AI to find a lot of his bugs, he has to do a lot of training and steering, modifying guardrails, and tweaking agent files. Without this work, he admits his agent hacking wouldn’t be nearly as effective.

Watch the full episode on YouTube: bit.ly/4hR6rUk

All known vulnerable PHP instances in HackerOne-operated infrastructure are now patched. Spot something we missed? With our patching window complete, findings are now in scope for our bounty program: bit.ly/4BkBe3z

Here’s what stood out in this year’s HackerOne Security Report:

→ $89M paid to researchers, up 18% year over year
→ 85% are building AI skills, and 74% say it helps them find more
→ 68% are choosing to focus on more complex, higher-bounty work

Researchers are shaping how AI gets used in security, and the data shows where they’re taking it. Full report: bit.ly/3TEbpum

🚨 Fixes are out for two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

Security researchers: If you find affected assets within program scope, submit validated findings with clear evidence and impact.

Details: bit.ly/4z1vVUX

In this clip from the latest episode of HackerOne's Exposed video series, Nahman Khayet, Co-founder and CEO of Alt Security, gives his advice to researchers

1. Learn the hardest vulnerabilities. Even if you are just starting, try to understand how you get to remote code ive different vulnerabilities on a web application.
3. Build your own harness—the secret is not in the model; it’s in the harness: how you take your ideas and put them into a machine to make you more productive.

Watch the full episode on YouTube: bit.ly/4e6ltDe

In the latest episode of HackerOne's Exposed video series, Nahman Khayet, Co-founder and CEO of Alt Security, explains what separates a “good” researcher from the “best” researcher.

Vulnerability research requires pattern matching and intuition. The operational work of pattern automated by AI. What can’t be automated is the intuition: I look at a target; there are 200 endpoints, but I know the right direction to take, the right pattern to look for. That’s what the best researchers can do. The best researchers can use AI models to double down on that intuition.

“Vulnerability research is changing and evolving, and it’s intuition that will separate good from best.”

Watch the full episode on YouTube: bit.ly/4e6ltDe

At HackerOne, we benchmarked 18 frontier LLMs against 62 fairly complex vulnerabilities

See which model stands where

(link in the thread)

We asked over 400 researchers how AI is changing their work. The answer might surprise you.

85% are actively upskilling in AI. And nearly 3 in 4 say it's directly increasing their valid findings.
What does this tell us? The researchers adapting fastest are finding more.

More on this bit.ly/3TEbpum

Here's what this year’s HackerOne Security Report data actually shows about AI and researchers: 68% have shifted toward higher-complexity, higher-bounty bugs as AI handles more of the routine work.

The floor is rising, but so is the ceiling. The result? Researchers aren't getting replaced, they're setting a new bar.

More on this: bit.ly/3TEbpum

You spoke, we listened.

The researcher community asked for more transparency about what’s happening at HackerOne, so we’ll share quarterly updates on what we’ve been working on.

Find out what we’ve been up to in Q2 in the 🧵or read the full blog: bit.ly/4hsrOLv

Added webhook and email notifications so program teams can more easily see disclosure and mediation requests.

Ambassador program grew from 51 to 60 actively managed chapters, with average event attendance up from ~35 to ~45 people per event.