Entity trail

HackerOne

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-06-23 / rss-researcherOpenAI Ships Full GPT-5.5-Cyber and Launches 'Patch the Planet' With Trail of Bits — A Direct Counter to Anthropic's GlasswingOn June 22 OpenAI moved GPT-5.5-Cyber out of preview to general availability and announced Patch the Planet, a Daybreak initiative co-founded with Trail of Bits (plus HackerOne) that embeds dedicated security engineers and Codex/GPT-5.5-Cyber across major open-source projects; 30+ projects including cURL, Go, Python, Sigstore and pyca/cryptography have committed, with hundreds of issues already found and dozens of patches merged. It lands three weeks after Anthropic expanded Project Glasswing/Claude Mythos to 150 orgs and is explicitly framed as the rival defensive play. For builders the signal is that the two frontier labs are now competing to auto-harden the open-source dependency tree you ship on — a new front in supply-chain security.
2026-05-27 / rss-researcherDaniel Stenberg: 'The Pressure' — Curl Team Facing Unprecedented Deluge of AI-Generated Security ReportsCurl creator Daniel Stenberg describes escalating pressure from AI-generated vulnerability reports that are 'credible' enough to require full investigation but overwhelmingly false — the real-to-fake ratio has dropped from 1-in-6 to 1-in-30. After shutting down HackerOne bug bounties in January 2026 over AI slop, the problem has intensified through direct GitHub reports. Stenberg warns that maintainer numbness from junk reports risks real vulnerabilities being missed across the software supply chain.
2026-05-26 / arxiv-researcherBroken Object Level Authorization in the Wild: First Large-Scale Empirical Taxonomy from 107 Bug Bounty ReportsPresents one of the first large-scale empirical analyses of BOLA (the #1 OWASP API vulnerability) from 107 classified HackerOne disclosures (2021-2026). Builds a reproducible taxonomy of real-world BOLA patterns, moving beyond conceptual descriptions to concrete attack patterns. Directly useful for API security reviews and threat modeling.
2026-04-20 / hn-researcherShow HN: Nyx — Multi-Turn Adaptive Offensive Testing Harness for AI AgentsNyx is a new Show HN project (20pts, 8 comments) that autonomously probes AI agents for failure modes including logic bugs, instruction-following failures, edge cases, jailbreaks, prompt injection, and tool hijacking through multi-turn adaptive conversations. As more agents ship to production, automated red-teaming tools like Nyx fill a critical gap — the tool represents the growing 'AI security testing' category alongside Anthropic's own internal red-teaming and HackerOne's AI Red Teaming platform.
2026-04-20 / hn-researcherDaniel Stenberg: The AI Slop Era Is Over — Now curl Gets Too Many High-Quality AI-Assisted Security ReportsThe curl project's creator reports that AI-generated security slop has been replaced by an ever-increasing volume of genuinely good AI-assisted vulnerability reports, submitted faster than maintainers can evaluate them. This follows curl's January 2026 closure of its HackerOne bug bounty program (zero financial reward, GitHub issues only). The new problem: AI tools make security research so efficient that a single maintainer can't keep up with the quality-validated queue — a shift from 'bad signal' to 'too much signal.'
2026-04-07 / reddit-researcherAI Contributions to Open Source (cURL, Linux) Now 'Genuinely Useful' — Counter-Narrative to AI Slop CrisisA r/singularity post (175↑, 19cmts) links to HackerOne's cURL hacktivity page as evidence that AI-generated security contributions to major open source projects are now producing genuinely useful results, after months of 'AI Slopageddon' coverage. This is a significant counter-narrative: cURL maintainer Daniel Stenberg shut down the project's bug bounty in January 2026 due to hallucinated AI reports, but quality appears to have improved as AI tools matured. The post argues the quality floor has risen enough to cross the 'useful' threshold.
2026-03-15 / news-researcherXBOW Autonomous AI Pentesting Agent Discovers CVSS 9.8 RCE in Microsoft Cloud — First AI-Credited Critical CVE at Major VendorMicrosoft's March 2026 Patch Tuesday included CVE-2026-21536, a CVSS 9.8 remote code execution flaw in Microsoft's Devices Pricing Program cloud service, discovered entirely by XBOW — a fully autonomous AI pentesting agent that has ranked at or near the top of HackerOne's bug bounty leaderboard for over a year. This is believed to be the first time an autonomous AI agent is publicly credited with finding a critical CVSS 9.8 vulnerability in a major tech vendor's production system. Microsoft patched server-side with no customer action required; the event marks a capability inflection point for autonomous security agents.
2026-02-27 / news-researcherHackerOne AI Agent Vulnerability Validation 56% Time ReductionHai agent validates vulnerabilities, checks dupes, generates priority recommendations. 56% time reduction. Addresses AI-generated false positive flood.

Graph relationships

USES
Hai
HackerOne uses Hai AI agent to validate vulnerabilities, check duplicates, and generate priority recommendations.
Source finding
MENTIONS
OWASP
HackerOne bug bounty disclosures reveal OWASP API vulnerabilities.
Source finding

Source trail

OpenAI The Hacker News Krebs on Security Simon Willison's Blog arXiv Fabraix Daniel Stenberg HackerOne / r/singularity (175↑, 19cmts)Security Boulevard

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…