Institution

Bugcrowd

Roles and affiliations follow the cited source. A source check is not an independent replication.

2026-05-13

QuestionWhere do agents stop between triggering a known bug and achieving demonstrated security impact?

Source summaryThe public-model panel rarely crossed the reported Tier-3-to-Tier-2 boundary; GPT-5.5 did so on one bug.

NUWA research note · independent review pending