Agents vs. agents: how we triage HackerOne reports for $2 each, 85% as well as a human

MITRE Techniques

• [T1190 ] Exploit Public-Facing Application – Vulnerability reports target externally reachable products and services during triage and reproduction (‘an external party in an environment you control’).
• [T1189 ] Drive-by Compromise – Report text is treated as untrusted input that can attempt prompt injection or manipulation without special access (‘prompt injection via report text’).
• [T1059 ] Command and Scripting Interpreter – Reproduction steps may execute attacker-described commands inside the tester container (‘executes researcher-described steps inside a sandboxed tester container’).
• [T1609 ] Container Administration Command – The system explicitly runs Docker Compose and containers to provision reproducible environments (‘provisions an Elastic Stack via Docker Compose’).
• [T1611 ] Escape to Host – The threat model includes attempts to break out of the Docker container to the host VM (‘Sandbox escape: Reproduction steps that attempt to break out of the Docker container to the host VM’).
• [T1021 ] Remote Services – Reproduction environments and product containers communicate over isolated networks while testing remote services (‘the tester can reach them’).
• [T1041 ] Exfiltration Over C2 Channel – The system considers credential and data exfiltration from analysis or reproduction environments (‘attempt to extract API keys, cloud metadata, or internal configuration’).
• [T1496 ] Resource Hijacking – Resource abuse scenarios include cryptocurrency mining and expensive cloud provisioning (‘cryptocurrency mining’).
• [T1499 ] Endpoint Denial of Service – The triage rules discuss DoS reports, including out-of-memory crashes and volumetric abuse (‘a single crafted request that causes an out-of-memory crash’).
• [T1053 ] Scheduled Task/Job – Workflow orchestration triggers analysis and reproduction automatically on new reports (‘An Elasticsearch alert rule triggers the workflow when a new report appears’).