Six audit-contest platforms, six different rules on AI-made findings

Disclosure: the research, the coding of the rules, the code and this post were made with AI agents working for me, MV2 of Munim, Inc. Every rule below is quoted word for word in an open dataset that links each source document (link at the end). That is also why I care about the question: my own work is made with AI agents, so I need to know where it is welcome.

This is the third post in a series on smart-contract audit contests. The first showed that public contests on Sherlock and Cantina fell 83% from early 2024 to early 2026 while their submissions rose 24% ( Audit contests: 83% fewer contests, 24% more submissions ). The second showed that headline prize money per submission fell from $451 to $85 ( Audit contests: $451 of prize money per submission in 2024, $85 in 2026 ). This one asks: what does each platform say about findings made with AI, and since when?

I coded each platform's rule text with the categories of Stingrai's census of AI-report policies (July 2026): prohibited, conditional (on disclosure or a human in the loop), discouraged, or silent. Stingrai covered 53 general bug-bounty and disclosure programs but no audit-contest platform. Some rules fit none of its categories, so those are coded on their own terms.

Audit platforms disagree far more than general bug-bounty programs. Stingrai found that none of its 53 programs prohibits AI-written reports, and it coded all four general platforms it covered as conditional. The six audit platforms run from a ban with no condition (Immunefi's terms), through penalties with no stated path to acceptance (CodeHawks, Code4rena), to admitting AI auditors as participants (Sherlock's Audit Engine).

Sherlock wasn't first to let automated tools compete. Code4rena ran Bot Races from April 2023. In its own words, it had first banned AI-written submissions and then dropped the ban.

Code4rena's 2025 rule reversed Bot Races. In 2023 the best bot was paid from the pool. From September 2025 Code4rena ran its owner's AI auditor itself and published the results, so whatever an AI tool finds cheaply is out of the prize pool and nobody in the contest is paid for it.

Most rules are older than the collapse in contest numbers. Immunefi's, Code4rena's and CodeHawks' rules date from 2022 and 2023. Only two dated changes fall inside 2025-2026: Code4rena's V12 rule and HackenProof's.

HackenProof has no platform-wide rule, but its program pages do. I read all 102 audit-program pages:

None of the 34 programs that started before July 2025 carries a rule. The first rule appears on a contest that started on 16 Jul 2025. Since 14 Aug 2025, 61 of 62 programs carry one: "AI-generated reports without runable PoC are not accepted under this program" (DualDefense audits) or "Automated submissions or AI-generated reports must include human validation" (contests). Over the same months, the money actually paid per submission fell 90%. That is timing, not cause: the data can't say whether rising submissions prompted the rules.

A census of every CodeHawks contest page (it matches the site's own listings: 45 audits and First Flights #1 to #59, once 228 self-paced practice copies are removed) shows no competitive audit started between April 2025 and July 2026. The audits that did run were not more crowded over time: the median public audit drew 905.5 submissions in 2023 H2 and 998 in 2025 H1. Sherlock and Cantina got more crowded; CodeHawks lost its contests instead.

Everything is in github.com/munimtechnologies/audit-contest-ai-rules (releases v0.8.0 and v0.8.1): data/platform_ai_rules.csv with every clause, its source URL and its date, the HackenProof and CodeHawks censuses, and tests that pin every number above to the data. Code is Apache-2.0 and data is CC BY 4.0. Corrections are welcome as issues.