The Trump Administration’s new Super Intelligence (SI) Task Force has an opportunity to shape how the United States approaches emerging SI security risks. To do so effectively, the Task Force should recognize and protect the security researchers who help identify and address emerging threats. 

The Hacking Policy Council (HPC) is a group of experts dedicated to creating a more favorable legal, policy, and business environment for good-faith security research, penetration testing, independent repair for security, and vulnerability disclosure and management. Our goal is to bridge gaps between security experts, businesses, and policymakers, advocating against legal measures that will restrict or chill defensive cybersecurity efforts and promoting resilience through the adoption of robust vulnerability management and disclosure policies.

Chaired by Director of National Intelligence Jay Clayton, the Super Intelligence Force will initially operate for 120 days. The Task Force is charged with commissioning a report at its outset to examine several critical issues, including the offense-defense balance in cybersecurity, mechanisms for early warning and notification of breaches, hacks, and jailbreaks, and the preparedness of government and the private sector for emerging threats.

These are important priorities. We believe that expressly identifying good-faith security researchers, ethical hackers, and the broader vulnerability disclosure community as stakeholders will better position the Task Force to secure the future of SI in the United States.

HPC encourages the Task Force to consider two priorities as it begins its work: (1) ensure its recommendations protect legitimate security research, and (2) directly engage with HPC and the security research community as key stakeholders in its assessments.

Protecting Good-Faith Security Research

Good-faith security researchers seek to improve cybersecurity by identifying and reporting vulnerabilities before malicious actors can exploit them. While they may use the same tools and techniques as malicious hackers, they seek to strengthen security, avoid harm, and responsibly disclose vulnerabilities so they can be addressed.

One of the Task Force’s responsibilities is to assess the offense-defense balance in cybersecurity in the context of advanced SI. Many cybersecurity tools and techniques have both offensive and defensive applications. Penetration testing, vulnerability research, red teaming, exploit development, and testing SI model flaws often use the same techniques as malicious actors. Conducted for legitimate purposes, however, these activities are essential to identifying and mitigating vulnerabilities before adversaries can exploit them.

SI-enabled tools can accelerate vulnerability discovery, automate aspects of security testing, and help defenders identify weaknesses across complex systems. Those same capabilities may also be used by malicious actors. While the risks associated with capabilities may warrant appropriate safeguards, decisions about liability should consider the researcher's intent and conduct, including concrete signs of good faith, such as whether they were authorized, took steps to avoid harm, and responsibly disclosed identified vulnerabilities. HPC has consistently advocated for policies that distinguish malicious cyber activity from good-faith security research.

The Task Force should ensure that its recommendations bolster the ability of security professionals and independent researchers to identify, test, and responsibly disclose vulnerabilities through vulnerability disclosure processes (VDPs). 

Safeguards addressing high-risk SI capabilities should be carefully designed to mitigate misuse without unnecessarily restricting legitimate security research. For example, a broad legal definition of SI could sweep in common security testing tools. Liability or export-control measures aimed at “hacking capabilities” could deter researchers and the organizations that support them. And breach and jailbreak notification mechanisms that do not distinguish researcher-reported findings from malicious exploitation could discourage disclosure or lead developers to restrict researcher access.

Security Researchers Must Be Part of the Conversation

Beyond protecting legitimate security research, the Task Force should directly engage the security research community as it conducts its assessments. Security researchers have practical, firsthand experience that can help policymakers understand how offensive and defensive cyber capabilities operate in real-world environments. Through penetration testing, red teaming, vulnerability discovery, and coordinated disclosure, researchers regularly identify weaknesses, evaluate defensive measures, and help organizations improve their security.

This expertise is particularly valuable to the Task Force’s assessment of the offense-defense balance. Researchers understand how dual-use capabilities can be employed to both compromise and protect systems, and how defensive practices must evolve alongside emerging threats. Researchers are also often the first to find model flaws, which makes them a natural part of the early warning mechanisms the Task Force is charged with reviewing. Existing channels, such as CISA's Coordinated Vulnerability Disclosure program, already cover SI systems and offer a foundation to build on.

Their experience is equally relevant to evaluating the preparedness of critical infrastructure and government systems. Independent security testing and vulnerability disclosure programs can identify vulnerabilities that internal processes or traditional scanning tools may overlook. For example, in FY 2025, public security researchers submitted more than 1,200 valid vulnerability reports to federal agencies, 90% of which were remediated, through CISA's Vulnerability Disclosure Policy Platform service, underscoring the important role independent researchers play in strengthening the security of government systems. Researchers can provide practical insights into where vulnerabilities arise, how organizations respond to them, and which policies and practices most effectively support remediation.

The Task Force’s charter provides several avenues for stakeholder engagement. That engagement should explicitly include independent security researchers, bug bounty platforms, vulnerability management providers, and red-teaming experts, and should begin early, while the Task Force’s assessments and recommendations are still taking shape within its limited initial time frame.

Strengthening SI Security Through Collaboration

Security researchers are not simply stakeholders affected by cybersecurity policy. They are experts whose work helps policymakers understand the threats they are trying to address. As SI capabilities evolve, the Task Force should ensure that efforts to address offensive SI capabilities do not inadvertently restrict legitimate security research and should treat security researchers as essential partners in assessing the offense-defense balance and the preparedness of government and critical infrastructure systems.

HPC welcomes the Task Force’s attention to these issues and stands ready to support its efforts to develop informed, practical recommendations that strengthen U.S. cybersecurity. We would welcome the opportunity to meet with Task Force leadership and relevant staff to share insights on the evolving offense-defense balance, effective vulnerability disclosure practices, and the role of independent security testing in securing advanced SI systems. Such a discussion could help inform the Task Force’s assessments and ensure its recommendations reflect the practical realities of defensive cybersecurity work.

‍