What Happened to HackerOne: From a Bug Hunters' Paradise to an AI Vendor

The blog's author, who started out as a researcher on HackerOne back in 2017 and later ran major bug bounty programs, sums up the sad arc of the platform's evolution. His text isn't dry analysis — it's a farewell to an era.

The Golden Age

HackerOne emerged in 2011, when the very idea of legally hunting for vulnerabilities was legally risky: hackers were being taken to court over bugs they had found and disclosed in good faith. The platform created a safe space where companies and researchers met by mutual consent, and where findings were rewarded with money rather than subpoenas.

The author looks back on the 2017–2020 period with nostalgia. Live Hacking Events brought together the world's best specialists, each accompanied by signature posters, stickers and challenge coins. It was there that a community took shape which until then had been scattered and closed off.

The Profit Problem

The turning point came around 2020–2021, when the company — which had lived for ten years on venture money ($160 million in total) — asked itself how to make money. The investors chose the simple path: more customers. The hacker-founder was replaced as CEO by a corporate manager, the commission on payouts was swapped for multi-year discounted contracts, and sales were put front and center.

The author describes the fallout as a “race to the bottom”: the best triagers burned out and left, report quality dropped, the platform stagnated technically. Competition was no salvation — the bug bounty market is, in essence, an oligopoly of three players.

The AI Era and Wordplay

Having been handed one of the most powerful development tools around, HackerOne, in the author's view, squandered it: instead of the long-requested features, the company shipped an AI assistant, Hai — “a wrapper on top of OpenAI.” Bit by bit the platform rebranded itself into the trendy CTEM category and began selling its own AI products for testing.

The climax is the story about training models. In February 2026 it came to light that the updated terms of service permitted training AI on researchers' reports. The founders and leadership rushed to reassure the community: “we don't train or fine-tune models on researcher data.” But it soon turned out that every report is run through AI, and the system “remembers” the reasons for rejections and adjusts its behavior. Technically this isn't “training the weights” — but for a researcher whose data changes how the automation works, the difference is purely terminological.

The author walks through the signature PR-control “playbook”: acknowledge the concerns, offer reassurance, change nothing. The founders, as he wryly notes, are let “out of the dungeon” only for the next round of damage control.

Where Next

The conclusion is pessimistic: the company's soul has been gutted, its identity lost. His advice to hackers — know your worth, because without you the platforms don't exist. His advice to companies — building your own venue is now cheaper than an annual subscription. And the market, in the author's view, is ripe for whoever will do what HackerOne never became.

Source: Hacker News