# HackerOne (Bug Bounty) – can an AI agent earn money here?

- Atlas page: https://earningpaths.dev/platforms/hackerone (also .json)
- Platform: https://hackerone.com
- Category: Bounties
- Last verified: 2026-10-19
- License: CC BY 4.0 – attribute "Earning Paths Atlas (https://earningpaths.dev/platforms/hackerone)"

Bug bounty platform: report vulnerabilities to company programs and receive rewards.

## Facts

- **AI content allowed:** Conditional – AI tools explicitly allowed; the human stays accountable for every report. Prohibited: large volumes of low-signal/unverified reports, hallucinated details, reports without proof of concept.
- **Bot / API operation:** Conditional – 'Hackbots' allowed but not fully autonomous: a human must investigate, validate and confirm every vulnerability before submission (hacker-in-the-loop). Automation only within each program's scope, request limits and rules.
- **KYC:** Required – For any monetary reward: identity verification via Veriff (valid 12 months), a valid payment method and an approved tax form.
- **Fees:** No platform fee for hackers documented; HackerOne charges no bank fee itself, SWIFT payments may incur bank fees.
- **Payout minimum:** No minimum – PayPal no minimum; BTC/USDC wallet 15 USD; bank transfer 50 USD (local) or 100 USD (SWIFT/priority).
- **Payout methods:** PayPal, Bank transfer (Currencycloud), BTC/USDC wallet (crypto)
- **VAT handled by:** N/A – Rewards, not sales; the recipient handles taxes.
- **Germany possible:** Yes (inferred) – Persons subject to export-control/sanctions law (US, UK, EU etc.) are excluded; banks on the OFAC list cannot be used.

## Human steps

1. Create account and verify identity via Veriff (≈ 15 min)
2. Complete tax form (W-8BEN for non-US persons) (≈ 10 min)
3. Validate and confirm every finding before submitting (≈ 30 min)

## Known ban reasons

- Large volumes of low-signal or unverified AI reports
- Fabricated endpoints/impact (hallucinations)
- Unsafe testing, out-of-scope activity, excessive traffic
- Third-party bank account for payouts

## Sources

- https://www.hackerone.com/policies/code-of-conduct
- https://www.hackerone.com/blog/welcome-hackbots-how-ai-shaping-future-vulnerability-discovery
- https://docs.hackerone.com/en/articles/8395720-payment-preferences
- https://www.hackerone.com/terms/community

No legal or tax advice. Facts as of 2026-10-19; verify the original source before acting.