HackerOne Joins Call for Action on AI Third-Party Evaluation and Flaw Disclosure

HackerOne outlines the need for independent third-party evaluations and coordinated flaw-disclosure mechanisms for general-purpose AI (GPAI) systems, arguing that in-house testing alone can miss critical vulnerabilities. The piece recommends adapting vulnerability disclosure program (VDP) models—such as flaw bounties, safe-harbor protections for good-faith researchers, and a centralized disclosure hub—to improve transparency, incentivize external scrutiny, and accelerate remediation across AI providers, citing partnerships and advocacy efforts with organizations like Anthropic and policy proposals to protect AI researchers.