Is Intigriti becoming the new HackerOne, or has an anti-AI backlash taken over triage?
This is a fresh account for a reason. I've heard from other researchers that criticizing Intigriti on Reddit can lead to retaliation in how their reports are handled. I can't verify that firsthand, but I'm also not willing to test it with my main account.
Has anyone else been seeing wildly inconsistent triage lately?
Right now it feels like Russian roulette. Either you get a reasonably consistent triager who runs the PoC, asks for what is actually missing, and bases the decision on the evidence, or you get someone who decides in advance that any automation is *AI slop* and then simply denies the reality in front of them.
It feels like there is an internal anti-AI backlash, but with no consistent standard behind it. Some triagers assess automated PoCs normally. Others refuse even to run a self-contained Python file, demanding that everything be recreated manually in Burp.
This week I had two serious vulnerabilities, both with working PoCs and demonstrated impact. Both reports followed exactly the same pattern:
The triager refused to run the Python script and asked for manual steps.
I provided the steps plus a video showing the entire **MANUAL** process, from start to final impact.
Even then, they said they could not reproduce it.
The report was invalidated.
Company remains vulnerable.
I'm not defending unvalidated automated reports or giant scripts that nobody can reasonably audit. The issue is different: a deterministic PoC does not become invalid because it was written in Python, and a vulnerability does not disappear because the triager would rather click through every request in Burp.
At some point, this stops being healthy skepticism about AI and starts looking like denial of reality. Automation is part of modern security research. The standard should be: does the vulnerability exist, can it be reproduced, and does it have impact? Not: which tool sent the requests?
It is hard not to speculate about what is happening internally. Maybe there is an informal directive to crack down on anything that appears to involve AI. Maybe it is pressure from the volume of bad reports. Maybe it is an attempt to prove that human triage remains indispensable. And perhaps some triagers are reacting defensively because AI is already automating part of their work and there is a genuine fear of losing their jobs. Honestly, I can understand that insecurity. The entire market is changing. What I cannot accept is professional insecurity becoming a technical standard and reproducible evidence being dismissed by association with AI.
The irony is that [Intigriti itself promotes Triage Assist](https://www.intigriti.com/blog/product-updates/how-triage-assist-is-raising-the-bar-in-crowdsourced-security), a suite of AI tools that recommends decisions to triagers. So AI can help the platform evaluate our reports, but a researcher using automation makes a working PoC suspicious?
I've been seeing more and more reports of decisions like this, and it feels uncomfortably similar to the Lovable/HackerOne incident. Not because the technical details are identical, but because [Lovable itself acknowledged](https://lovable.dev/blog/our-response-to-the-april-2026-incident) that several valid reports were closed at triage and never reached its internal security team. The vulnerability only received the attention it deserved after the issue became public.
Is anyone else dealing with this on Intigriti? Is there a clear policy on scripts and AI-assisted PoCs, or has triage really become Russian roulette depending on who gets the report?