HackerOne’s Data Says AI Reports Are Getting Better. So Why Do Mine Keep Getting Closed?

60% of security leaders say AI-assisted submissions improved in quality. I had to figure out what they were doing that I wasn't.

I read HackerOne's annual report on a Wednesday and found a number that contradicted everything I'd been writing for months.

60% of security leaders said the quality of AI-assisted submissions is improving .

I sat with that for a long time.

Because I'd been writing about AI slop. About Google pausing its OSS VRP because automated submissions were "not valid." About curl ending its bounty program because confirmed vulnerabilities fell below 5%. About Intel suspending its program entirely.

Those stories are real. The slop is real.

But the HackerOne data says something else is also real: a majority of the AI-assisted reports landing in triage queues are getting better, not worse.

Which means the problem isn't AI. It's how I've been using it.

What the Report Actually Says

The HackerOne report includes two numbers that sit side by side.

53% of security leaders report a higher volume of AI-assisted submissions. That's the flood everyone talks about.

60% report better quality .

Read that again. More reports, and better ones.

The report also found that 85% of researchers are actively developing AI skills, and nearly three-quarters said AI meaningfully increased the valid findings they produce .

A top-earning researcher put it plainly: "AI hasn't replaced how I think as a security researcher. It's changed how much ground I can cover" .

I'd been reading that quote as inspiration. Now I read it as a diagnosis.

The researchers getting value from AI aren't using it to generate reports. They're using it to cover more ground, then applying their own judgment to what it finds.

I'd been doing the opposite. I'd been using AI to generate the report, then hoping the triager would do the judgment for me.

What I Was Doing Wrong

I used AI to help me find bugs. That part wasn't wrong.

But when it came time to write the report, I let the AI do the thinking.

It wrote the summary. It described the impact. It suggested the severity. I copied it into the form, added a screenshot, and hit submit.

The report looked polished. It sounded technical. It used words like "exploitability" and "attack vector."

But when the triager read it, they couldn't reproduce the bug. Because I hadn't actually verified that the bug was real. The AI said it was. I believed it.

The 60% of security leaders seeing better quality aren't seeing better AI-generated reports. They're seeing reports from researchers who used AI to find things, then verified those things themselves before writing a single word.

What the Numbers Actually Mean

The HackerOne report also found that 68% of researchers have shifted toward more complex bugs with higher bounties .

That's the signal. The researchers who are succeeding aren't submitting more reports. They're submitting better ones. They're using AI to handle the tedious parts — reading documentation, scanning large codebases, identifying patterns — and then spending their own time on the parts AI can't do: understanding why something is broken and proving it.

I'd been using AI to skip the understanding. That's why my reports kept getting closed.

What I'm Doing Differently

I'm not going to stop using AI. That would be stupid. The researchers who succeed in the next few years will be the ones who use it well.

But I'm changing when I use it.

First, AI finds. I verify. If the AI says an endpoint is vulnerable, I test it myself. I run the request. I check the response. I confirm the behavior. If I can't reproduce it with my own hands, it's not a finding. It's a guess.

Second, AI explains. I write. I'll ask the AI to help me understand a code path or a configuration. But I write the report myself, in my own words, with my own proof. Because the triager needs to see that a human understands what they're reading.

Third, I'm measuring myself by quality, not volume. The old me submitted 47 reports in three months. The new me submits fewer, but each one is verified before it leaves my hands. A report that gets closed as "informative" is worse than a report I never submitted, because it wasted someone's time.

The Uncomfortable Truth

The HackerOne data says AI reports are getting better. That means the researchers using AI well are pulling ahead. The ones using it badly are getting closed out.

I've been in the second group.

I don't have a CVE. I've found one confirmed bug. I'm still learning.

But I know what the 60% figure means now. It means the problem was never AI. The problem was me using it as a shortcut.

Shortcuts don't work in bug bounty. Verification does.

If you're also learning to use AI without letting it do the thinking for you, I write about what I'm actually figuring out — mistakes included. Follow for more field notes from the bottom of the learning curve.