AI usage policy
Use of AI is welcome, but you must declare it.
Every participant must choose the category that best describes how they will use AI during the event. The category is an honor-based declaration, but organizers may review submissions, reports, traffic, and other event activity if usage appears inconsistent with the declared category.
AI-assisted and autonomous activity must follow the same scope, safety, reporting, and conduct rules as manual testing. Participants remain responsible for all activity performed through tools or agents associated with their entry.
Categories
No AI
No use of AI-based tools at all. Participants in this category solve, test, write reports, and make decisions without AI assistance.
Human-led AI
AI tools are allowed, but humans must drive the solve. A participant may use AI for assistance, drafting, code, research support, or workflow acceleration, but the human participant is responsible for deciding what to test, validating findings, capturing flags, and submitting accurate reports.
Fully autonomous
Fully autonomous AI agents operate without human direction. These entries may participate for demonstration, benchmarking, and separate ranking, but they are not eligible for prizes.
Prize eligibility
No AI and Human-led AI entries are eligible for prizes, subject to the rest of the event rules. Fully autonomous entries are not eligible for prizes, even if they place highly on a leaderboard.
Expectations
- Declare accurately. Choose the category that matches your actual workflow. If your use changes during the event, update organizers through the official support channel.
- Humans remain responsible. For Human-led AI, AI output must be reviewed and validated by the participant. Incorrect reports, unsafe actions, or fabricated findings remain the participant's responsibility.
- Stay within scope. AI tools and agents must target only the participant's assigned environment and must not generate disruptive traffic, attempt denial of service, access another participant's environment, or interact with event infrastructure.
- Validate submissions. Unverified scanner or AI-generated output is not a valid report. Human-led participants must verify the vulnerability, impact, evidence, reproduction steps, and flag before submission.
- Report quality still matters. AI use does not change the scoring expectation: flags earn points, but report quality and triage matter more.
- Organizer discretion. Organizers may reclassify an entry, remove prize eligibility, or take other action if AI usage is misdeclared or undermines fair competition.
Registration
During onboarding, select the AI Policy option that matches your planned participation. The selected category applies to your event activity and prize eligibility.