PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How AI Security Is Transforming Offensive Security: Insights to Carry Into 2026

hackerone.com | blog | #ai-security | #bug-bounty | #automation | #offensive-security | #vulnerability-trends | #hpsr | #hackbots
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne's 9th HPSR shows hackbots submitted 1,100+ reports, nearly half valid with 78% of valid findings XSS, while AI vulnerabilities surge and automation expands baseline coverage.
Published
Collected

Related coverage

blog · hackenproof.com
How We Built an Autonomous AI Security Triager: From LLM to 20,000+ Real Reports
AI made bug hunters sharper, and report volume doubled. How HackenProof built an autonomous AI triager that now handles 70% of submissions.
blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
blog · hackerone.com
Hacking in the Age of AI: A New Way to Understand Human + Machine Contributions
The HackerOne leaderboard now distinguishes between individual researchers and AI-powered collectives, bringing fairness, clarity, and transparency to security contributions.
blog · hackerone.com
The Rise of Autonomous Hackbots in Cybersecurity
Hackbots combine LLMs, tool harnesses, and computer-use abilities to dynamically hack applications beyond what rigid scanners can do; startups are already deploying them.
blog · hackerone.com
The HackerOne Global Top 10—Hacker Expertise, Industry Data, and Up-to-Date Vulnerabilities
The HackerOne Global Top 10 complements the OWASP Top 10 with continuously updated, industry-specific vulnerability data from real hacker reports, helping teams prioritize against current threats.
blog · hackerone.com
The Rise of IDOR
IDOR lets attackers access other users' data via tweaked parameters, 200+ found monthly on HackerOne. The article covers IDOR types, Shopify and Parler cases, and why tools alone can't find them.
Back