Loading story…
HackerOne announced a Good Faith AI Research Safe Harbor framework intended to give AI security and safety researchers clearer authorization and legal protections when testing AI systems in good faith. The initiative is positioned as an industry standard to reduce legal ambiguity that can deter responsible AI testing, and it builds on prior efforts such as the U.S. Department of Justice’s 2022 policy shift on “good faith” security research under the Computer Fraud and Abuse Act (CFAA) and HackerOne’s earlier Gold Standard Safe Harbor model for traditional vulnerability research.
Under the framework, participating organizations can publicly signal adoption (e.g., via a profile “banner”) and commit to specific protections, including refraining from legal action, offering limited exemptions from restrictive terms of service, and supporting researchers if third parties pursue claims tied to authorized research. HackerOne leadership argued that AI testing can involve techniques and outcomes that do not fit neatly into conventional vulnerability disclosure norms, making a dedicated safe-harbor approach necessary to accelerate identification and remediation of AI-related risks across products and services.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
HackerOne announced a new Good Faith AI Research Safe Harbor framework to give researchers explicit authorization and legal protections for testing AI systems in good faith. The framework extends safe-harbor concepts from traditional software security research to AI and commits adopting organizations to avoid legal action, limit restrictive terms enforcement, and support responsible disclosure.
The U.S. Department of Justice issued a 2022 charging policy stating it would not pursue Computer Fraud and Abuse Act cases against good-faith security research. The policy later served as a foundation for arguments that legal protections should extend to AI security testing.
HackerOne launched its Gold Standard Safe Harbor in 2022 to provide clearer authorization and legal protections for traditional software vulnerability research. This framework became the basis for its later AI-focused safe harbor model.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecyberscoop.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The European Commission has unveiled an Action Plan on Cybersecurity and Artificial Intelligence aimed at strengthening cyber resilience while reducing dependence on foreign AI providers. The plan sets out nine measures to widen trusted access to frontier AI models for vetted cybersecurity organizations, improve model evaluation, support vulnerability discovery and coordinated disclosure, and expand AI use in threat detection and incident response. It builds on existing frameworks including **NIS2**, the **Cyber Resilience Act**, and the **AI Act**, and reflects growing concern that advanced AI capabilities critical to cyber defense are concentrated among a small number of mostly non-European vendors. The move comes as security researchers report that both legal exposure and AI access restrictions are hindering good-faith cyber defense work. A recent Lawfare-cited study found researchers in the U.S. and U.K. often abandon projects, limit disclosures, or avoid certain targets because of risks tied to terms of service, the **CFAA**, **DMCA**, **CMA**, defamation, and fraud claims. At the same time, researchers interviewed by TechCrunch said guardrails and vetted-access programs from major AI vendors can block exploit validation, reverse engineering, and vulnerability research, pushing some defenders toward locally run open-source models. OpenAI has separately promoted a trusted-access approach for cyber defense, underscoring a broader policy shift toward controlled but expanded AI availability for legitimate security work.
Jul 24, 2026
NVIDIA, Palantir, Hugging Face, Microsoft, Adobe, IBM, Red Hat, SpaceX and other partners have launched the **Open Secure AI Alliance**, a 33-member industry effort aimed at improving the security of open-source software and open-weight AI models. The group said it will develop open techniques and tools for faster vulnerability identification, disclosure, and patching, while building on existing work from the Linux Foundation's Akrites initiative and **OpenSSF**. Organizers said the push reflects growing concern that defenders need AI systems they can inspect and run on their own infrastructure, citing lessons from the recent Hugging Face security incident. The alliance is also positioning AI security beyond model behavior alone, emphasizing infrastructure risks such as provenance, identity, deployment accountability, and secure data pipelines. NVIDIA argued that open models and open harnesses can improve transparency, incident response, and shared remediation, and pointed to its open-source **NVIDIA Labs Object-Oriented Agent (NOOA)** project as a contribution for testing, tracing, auditing, and governance of AI agents. Supporters said the initiative could help establish common standards for securing AI infrastructure, though some observers criticized its largely U.S.-centric membership and called for broader international participation.
Aug 11, 2026
The White House is negotiating a voluntary oversight framework with major frontier AI developers that would allow companies to submit advanced models to the federal government up to 30 days before public release for classified cyber-capability testing. According to reporting, the program could be tied to eligibility for federal funding, with agencies including **NIST** and **CISA** involved in designing or conducting evaluations, while tested models may also be shared with federal agencies and selected corporate partners. The effort has drawn criticism for secrecy and unclear scope, with lawmakers, researchers, and smaller AI firms saying the administration has not disclosed which models are covered, how benchmarks work, or how decisions will affect competition. The debate has intensified amid concerns about model containment failures and the ability of advanced systems to generate sophisticated exploit paths, including techniques associated with container and Kubernetes escape scenarios, runtime abuse, and host-level privilege escalation tied to vulnerabilities such as `CVE-2019-5736`, `CVE-2022-0811`, and `CVE-2024-21626`.
Aug 7, 2026