# How Elastic Uses an AI Agent to Triage HackerOne Bug Bounty Reports

DevFeed: [How Elastic Uses an AI Agent to Triage HackerOne Bug Bounty Reports](<https://devfeed.tech/articles/agents-vs-agents-how-we-triage-hackerone-reports-for-2-each-85-as-well-as-a-human-48844.md>)

Original publisher: [Read original article](<https://www.elastic.co/security-labs/blog/ai-vulnerability-triage-bug-bounty-hackerone>)

Author: Ioannis Kakavas

Published: 2026-08-04T00:00:00Z

Content type: article

Language: en

Sources: [Elastic Security Labs](<https://devfeed.tech/sources/elastic-security-labs.md>)

Topics: [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Bug Bounty](<https://devfeed.tech/topics/bugbounty.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [software-architecture](<https://devfeed.tech/topics/software-architecture.md>), [Scalability](<https://devfeed.tech/topics/scalability.md>), [virtual machines](<https://devfeed.tech/topics/virtual-machines.md>)

Tags: [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-automation](<https://devfeed.tech/tags/ai-automation.md>), [architecture](<https://devfeed.tech/tags/architecture.md>), [bug-bounty](<https://devfeed.tech/tags/bug-bounty.md>), [llms](<https://devfeed.tech/tags/llms.md>), [reports](<https://devfeed.tech/tags/reports.md>), [scaling](<https://devfeed.tech/tags/scaling.md>), [security](<https://devfeed.tech/tags/security.md>), [virtual-machines](<https://devfeed.tech/tags/virtual-machines.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

Elastic built an AI triage agent for HackerOne vulnerability reports after a rise in AI-generated submissions. The system matches human security-engineer decisions 85% of the time on 764 known-outcome reports, costs roughly $2 per report, and keeps a human responsible for the final decision.

## Source excerpt

LLMs made it cheap to flood bug bounty programs with submissions. Here's how Elastic built an AI triage agent that matches human decisions 85% of the time, including the architecture, threat model and calibration against 3,300 real reports