HackerOne's AI triage bot reportedly rejected a security researcher's vulnerability report because the CVE identifier it cited appeared to come from the future, and the researcher got past the block by altering the ID.
Bug bounty · HackerOne AI triage
An AI filter rejected a valid CVE for being "from the future"
The bot reportedly judged the year in a CVE identifier impossible. The researcher got the report through by altering the ID, exposing how rigid date assumptions can block legitimate submissions.
The year mismatch
Where the bot's assumed date sat relative to the year printed in the identifier
2024 · bot's assumed year
2026 · year in CVE ID
Gap the bot treated as impossible
Timeline drawn to scale: the two years are shown as points on one axis.
2024
Year the bot apparently believed was current
2026
Year designation in the rejected CVE identifier
1 edit
Replacing the year let the report go through
How the block played out
Report flow as described in the reporting
STEP 1
Report submitted
Cites CVE-2026-114820
→
STEP 2
Bot flags the year
Treats 2026 as impossible
→
STEP 3
Report rejected
Vulnerability never assessed
→
STEP 4
ID altered, resubmitted
Year replaced with [redacted]; report accepted
Core issue
The failure was a validation rule, not the vulnerability's technical merit.
A fixed sense of the current date treated a valid-looking identifier as impossible.
Filters meant to reduce AI-generated noise can also block legitimate reports.
Researchers who must work around a block may have no clear appeal path.
Critic's view
Dormann argued HackerOne is answering AI-generated noise with another layer of AI processing, which carries the same rigidity risks.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article...