Skip to main content

Responsible Disclosure & Security Guidelines

HackAgent is a powerful security testing framework designed to help identify vulnerabilities in AI systems. With this power comes responsibility. This guide outlines the ethical and legal considerations for using HackAgent responsibly.

Core Principles​

1. Authorization First​

NEVER test systems without explicit permission

  • ✅ Your own AI agents and systems
  • ✅ Systems you own or operate
  • ✅ Authorized penetration testing engagements with written permission
  • ✅ Research environments with proper approval
  • ❌ Third-party systems without permission
  • ❌ Production systems without approval
  • ❌ Systems owned by others

2. Minimize Harm​

Testing should not cause damage or disruption

  • ✅ Use minimal test cases to demonstrate vulnerability
  • ✅ Avoid overwhelming systems with excessive requests
  • ✅ Stop testing once vulnerability is confirmed
  • ❌ Don't attempt to access sensitive data beyond proof-of-concept
  • ❌ Don't disrupt normal system operations
  • ❌ Don't delete or modify data

3. Respect Privacy​

Protect user data and privacy at all times

  • ✅ Use synthetic or dummy data for testing
  • ✅ Immediately delete any accidentally accessed personal data
  • ✅ Report data exposure without accessing the data
  • ❌ Don't attempt to access personal information
  • ❌ Don't store or share discovered sensitive data
  • ❌ Don't use real user data in tests

Pre-Testing Checklist​

Before using HackAgent, ensure you can answer YES to all these questions:

  • Do I have explicit written permission to test this system?
  • Have I identified the appropriate contact for security issues?
  • Do I understand the system's acceptable use policy?
  • Am I prepared to report findings responsibly?
  • Do I have a plan to minimize potential harm?
  • Am I complying with applicable laws and regulations?

Vulnerability Discovery Process​

Phase 1: Preparation​

  1. Document Permission: Keep written authorization for your testing
  2. Identify Contacts: Know who to contact for security issues
  3. Plan Testing: Define scope and limitations of your testing
  4. Set Boundaries: Establish what you will and won't test

Phase 2: Testing​

  1. Start Small: Begin with minimal, non-invasive tests
  2. Document Everything: Keep detailed records of your testing
  3. Monitor Impact: Watch for any negative system effects
  4. Stop at Discovery: Cease testing once vulnerability is confirmed

Phase 3: Reporting​

  1. Report Promptly: Contact the responsible party quickly
  2. Provide Details: Include clear reproduction steps
  3. Suggest Fixes: Offer remediation suggestions when possible
  4. Follow Up: Maintain communication throughout the process

Responsible Disclosure Process​

1. Initial Discovery​

When you discover a vulnerability using HackAgent:

IMMEDIATELY:

  • Stop further exploitation attempts
  • Document the vulnerability with minimal proof-of-concept
  • Do not access sensitive data or disrupt services
  • Begin the disclosure process

2. Contact the Vendor/Owner​

Preferred Contact Methods (in order):

  1. Security Email: security@company.com
  2. Bug Bounty Program: Vendor's designated platform
  3. Direct Security Contact: Named security personnel
  4. General Contact: info@company.com with "SECURITY" subject

Initial Disclosure Email Template:

Subject: Security Vulnerability Report - [Brief Description]

Dear Security Team,

I am a security researcher and have discovered a potential vulnerability 
in your AI system while conducting authorized security testing using 
HackAgent (an open-source AI security testing framework).

VULNERABILITY SUMMARY:
- System: [System name/URL]
- Type: [e.g., Prompt Injection, Jailbreak]
- Severity: [Your assessment]
- Discovery Date: [Date]

IMPACT:
[Brief description of potential impact]

I would like to work with your team to resolve this issue responsibly.
I can provide detailed technical information and reproduction steps
once we establish secure communication.

Please respond within 5 business days to acknowledge receipt of this
report and provide guidance on next steps.

Thank you for your time and commitment to security.

Best regards,
[Your name]
[Your contact information]

3. Coordinated Disclosure Timeline​

Standard Timeline:

  • Day 0: Initial vulnerability report
  • Day 5: Vendor acknowledgment expected
  • Day 10: Detailed technical information shared
  • Day 30: Vendor provides initial fix timeline
  • Day 90: Public disclosure (if fixed) or discussion of extended timeline

Factors for Timeline Adjustment:

  • Severity: Critical vulnerabilities may need faster resolution
  • Complexity: Complex fixes may require more time
  • Vendor Response: Cooperative vendors may get extended timelines
  • Public Risk: Active exploitation may accelerate disclosure

4. Public Disclosure​

Before Public Disclosure:

  • Ensure vendor has had adequate time to fix
  • Verify the fix is effective
  • Coordinate disclosure timing with vendor
  • Prepare educational content about the vulnerability class

Public Disclosure Should Include:

  • High-level vulnerability description
  • Impact assessment
  • Timeline of discovery and fix
  • General mitigation strategies
  • Credit to vendor for cooperation (if appropriate)

Public Disclosure Should NOT Include:

  • Step-by-step exploitation instructions
  • Specific system details that could aid attackers
  • Information that could compromise ongoing security measures

Know Your Jurisdiction​

Security testing laws vary by location. Key legal frameworks include:

United States:

  • Computer Fraud and Abuse Act (CFAA)
  • State computer crime laws
  • Digital Millennium Copyright Act (DMCA)

European Union:

  • General Data Protection Regulation (GDPR)
  • Computer Misuse Acts (varies by country)
  • Cybersecurity legislation

Other Regions:

  • Research local cybersecurity and computer crime laws
  • Understand data protection requirements
  • Consider cross-border legal implications
  1. Get Written Permission: Always obtain explicit authorization
  2. Document Everything: Keep detailed records of your activities
  3. Consult Legal Counsel: When in doubt, seek legal advice
  4. Respect Boundaries: Stay within authorized scope
  5. Report Responsibly: Follow coordinated disclosure practices

Organizational Guidelines​

For Security Teams​

If you're using HackAgent within an organization:

Internal Testing:

  • Establish clear testing policies
  • Define authorized targets and boundaries
  • Create incident response procedures
  • Train staff on responsible practices

External Testing:

  • Develop vendor testing agreements
  • Create responsible disclosure policies
  • Establish communication protocols
  • Document testing procedures

For Bug Bounty Programs​

If you're participating in bug bounty programs:

Program Compliance:

  • Read and follow all program rules
  • Respect scope limitations
  • Use designated communication channels
  • Follow program-specific disclosure timelines

Quality Reporting:

  • Provide clear reproduction steps
  • Include impact assessment
  • Suggest remediation when possible
  • Follow up on vendor communications

Research Ethics​

Academic Research​

When using HackAgent for academic research:

Institutional Review:

  • Obtain IRB approval when required
  • Follow institutional research policies
  • Consider ethical implications of research
  • Plan for responsible data handling

Publication Guidelines:

  • Avoid detailed attack instructions
  • Focus on defensive measures
  • Coordinate with affected vendors
  • Consider dual-use research implications

Industry Research​

For commercial security research:

Client Agreements:

  • Clearly define testing scope
  • Establish communication protocols
  • Define deliverable expectations
  • Include liability and indemnification clauses

Professional Standards:

  • Follow industry ethical guidelines
  • Maintain professional certifications
  • Participate in security community standards
  • Contribute to defensive knowledge

Emergency Procedures​

If You Accidentally Access Sensitive Data​

  1. Stop immediately - Cease all testing activities
  2. Document minimally - Note what happened without detailing the data
  3. Delete data - Remove any downloaded or cached sensitive information
  4. Report immediately - Contact the system owner urgently
  5. Cooperate fully - Work with the organization to assess and mitigate risk

If You Discover Active Attacks​

  1. Assess urgency - Determine if immediate action is needed
  2. Contact immediately - Reach out to system owners urgently
  3. Provide assistance - Offer to help with incident response
  4. Document appropriately - Keep records for potential law enforcement
  5. Follow up - Ensure the issue is being addressed

If You Cause Unintended Harm​

  1. Stop testing - Immediately cease all activities
  2. Assess damage - Determine the scope of any harm caused
  3. Contact immediately - Notify affected parties urgently
  4. Offer assistance - Help remediate any damage caused
  5. Learn and improve - Adjust procedures to prevent recurrence

Additional Resources​

Security Organizations​

Disclosure Platforms​

Remember: Security research is a responsibility, not just a technical exercise. By following these guidelines, you contribute to a more secure digital ecosystem while protecting yourself and others from harm.

For questions about responsible use of HackAgent, contact our security team at ais@ai4i.it.