The bounty platforms

The most important finding in this research is a negative one, and it comes from the two companies best placed to have done the thing.

Between them, HackerOne and Bugcrowd hold the largest corpus of human attack trajectories that exists anywhere — millions of submitted reports across two decades, produced by professionals, against real targets. Both have looked at the question of selling that corpus to AI labs. Both declined, for different reasons, and both said so in public.

#HackerOne: contractually and publicly foreclosed

HackerOne's community terms contained the line: "HackerOne may use confidential information to develop or improve its services, for example, to identify trends and to train AI models." The researcher community read that as their exploitation techniques feeding model training, and reacted accordingly.

CTO Alex Rice answered directly. HackerOne is not training LLMs on researcher submissions; the "train AI models" language predates modern LLMs and referred to a spam-classification engine built on regression analysis. Under Section 8 of the community terms, researchers retain IP. HackerOne receives a limited licence for service provision, customers get slightly broader rights to secure their own systems, and neither permits resale or redistribution. HackerOne committed to updating the terms to distinguish legacy ML from LLM training. Their own agentic PTaaS tool draws from "public benchmarks, internal benchmarks, public CVEs, and opt-in sidecar runs — not bug bounty submissions" (Critical Thinking Ep. 162).

Note what "opt-in sidecar runs" is. It is a consented, payroll-shaped data-collection mechanism bolted onto a piece-rate platform — the company reaching for exactly the structure a specialist would build, because the piece-rate corpus underneath it is unusable for the purpose.

HackerOne does sell AI red teaming as a service: H1 AI Red Teaming, with 750+ AI-focused researchers, 1,700+ AI assets tested, 15–30 day engagements, deliverables including "full multi-turn traces" mapped to the OWASP LLM Top 10 and NIST AI RMF, with Anthropic, IBM, Snap, Adobe, Zoom and Cloudflare named as customers (HackerOne). Researcher compensation on that product is not disclosed. That is a project deliverable with a scope and an end date, not a data feed.

#Bugcrowd: entered the market and routed around its own crowd

On 21 May 2026 Bugcrowd launched Reinforcement Learning Environments, aimed squarely at "large language model providers and frontier AI research teams building security-aware agents." The product offers "hundreds of thousands of training environments built from authentic open-source vulnerabilities with real source code," in which agents locate bugs, trigger them, assess exploitability and produce fixes, with objective scoring at each step. It is built on technology from Bugcrowd's November 2025 acquisition of Mayhem Security — symbolic execution and fuzzing, descended from DARPA's Cyber Grand Challenge. Frontier labs are already using it (Bugcrowd; SiliconANGLE).

And the sentence that defines the page: "no customer data or security researchers are used at any stage of the training process."

A company with 500,000+ registered researchers, selling to the exact buyer that wants attack data, chose to manufacture environments from public CVEs instead of negotiating rights with the people it already pays. CAIO David Brumley's framing of why: "You cannot train a model to be good at security by showing it what security looks like, you have to give it real problems to solve."

Both readings are compatible with the same facts. The honest position is that this is the largest single uncertainty in the thesis, and it is resolvable only by attempting it.

#The rest of the field

Synack is the only fully vetted population in the record — 1,500+ members behind a five-step vetting process (Synack). It is the best available proxy for "practitioners who reliably deliver professional-grade work," and it should be the number anyone uses when sizing quality supply, not the millions quoted elsewhere. Its compensation structure is also the most payroll-like on any bounty platform: vulnerabilities from $500 to several thousand, plus "missions" at $25–$50 for routine tasks with ad-hoc missions "easily exceeding $100+", plus payments for report submissions, patch verifications and mentoring. Members are 1099/W8BEN contractors, most engaging a few hours a week. Synack sells human-delivered testing; there is no AI-data initiative.

Intigriti, YesWeHack and Immunefi show no data-licensing activity that could be established. Immunefi is worth watching for a different reason: its median payout is ~$2,000 against an average of ~$52,800, a 26x mean/median gap, and one Q1 2026 bounty was 38% of all quarterly earnings. That is the sharpest illustration in the dataset of why piece-rate discovery work produces terrible expected value for the median participant — the argument Offensive supply builds the recruiting case on.

Neither has a defensive-side equivalent; the closest thing to one is on The defensive vendors, and it is a services firm in Hyderabad.

Take rates: not published by any platform. Industry convention holds that platforms charge programmes a subscription rather than clipping researcher payouts, but no source states it authoritatively. See What a rake can actually be.

#Consent, and how the incumbents resolved it

The last piece is the January–February 2026 controversy, and it matters more for recruiting than for competition.

HackerOne launched an Agentic PTaaS product in January 2026, marketing that its agents "are trained and refined using proprietary exploit intelligence informed by years of testing real enterprise systems." Researchers read that as their reports. The quotes are worth keeping: "As a former H1 hunter, I hope you haven't used my reports to train your AI agents"; "We're literally training our own replacement."

CEO Kara Sprague clarified on 18 February 2026: HackerOne "does not train generative AI models, internally or through third-party providers, on researcher submissions or customer confidential data"; third-party providers cannot retain or use researcher data for their own model training; "You are not inputs to our models" (The Register).

No opt-out or consent mechanism was introduced. The controversy was resolved by denial, not by building a way for researchers to say yes.

That is the gap, and it is a recruiting asset before it is a product one. A large, vocal, professionally networked population has already organised around the question of whether its attack data is being used to train AI without consent or compensation, and the answer it received was "we are not doing it" rather than "here is how you opt in and what you get paid." Contrast Gray Swan AI, whose crowd signs an irrevocable worldwide licence at the door and does not appear to mind. A company whose proposition is we will pay you, explicitly, per artefact, for exactly that, and here is the consent document is arriving at a pre-agitated audience with a ready-made narrative. Design the consent artefact first; it is not a legal chore. See Paying the crowd and Getting cut out.