A building inspector who must telephone the fire service within 24 hours of discovering a pickable lock is not a bad idea. It becomes a bad idea when the inspector owns the building, the telephone call can be entered into evidence, and the person who picked the lock has no legal protection for having tried.

That is the architecture of the problem now facing ethical hacking. Since 11 September 2026, the EU Cyber Resilience Act has required manufacturers of products with digital elements to issue a 24-hour early warning and a 72-hour notification for actively exploited vulnerabilities and severe incidents. Concurrently, autonomous agents have begun generating findings at a volume the disclosure infrastructure was never staffed to receive.

The collision is not between hackers and regulators. It is between two clocks built for different machines.

Objection: The Deadline Rewards the Willfully Blind

The argument for the CRA is sound. Europe has spent two decades importing software whose maintainers answer to nobody, and a notification deadline forces a name onto the liability.

The argument against it deserves equal airtime. A clock measured from "awareness" rewards organizations that never read their inbox. A 24-hour obligation favors a vendor with a round-the-clock legal-and-SOC bridge and penalizes a firmware house with three engineers and a reseller in Rotterdam. Chapter IV also arrives roughly fourteen months before the rest of the Act, requiring a reporting function before manufacturers have completed the conformity work that tells them what is inside their own product.

There is a sharper objection still. Premature detail on an actively exploited vulnerability hands attackers a roadmap. The regulation addresses this through confidential notification to coordinators, but that promise now coexists with a mandate to populate the European Union Vulnerability Database. Whether confidentiality and publication can be operated simultaneously is an unresolved engineering question, not a settled legal one.

The Bounty Price Signal Inverts

Commentary treats bug bounties and the CRA as parallel systems. They are competing buyers of the same artifact.

A bounty pays for discovery. A regulatory notification pays for timely, credible evidence of exploitation. Once the second obligation is enforceable, a manufacturer's rational strategy shifts from rewarding external researchers to detecting the condition first — because a finding delivered by a third party starts a clock the manufacturer did not choose.

The consequence is repricing, not disappearance. Injective parameters, permissive CORS policies and enumerable object references will migrate to continuous agent scanning and attract near-zero marginal bounties. Premiums will move toward cross-tenant authorization failures, approval-workflow bypasses and multi-step chains requiring an attacker to understand what the business believes it is doing.

Verizon's 2025 DBIR found that 75% of breaches involved no malware. A discovery economy optimized for injectable bugs has been measuring a different threat from the one that actually breaches organizations. The market is finally correcting that mismatch.

The Proof of Concept Has Changed Legal Category

The most consequential shift appears in no press release: the proof of concept is now a regulatory trigger.

A credible demonstration of active exploitation can be the fact that starts a manufacturer's notification duty. The researcher who supplies it has handed a legal entity a deadline. Some manufacturers will respond with a bounty. Others will dispute the characterization, contest severity, or argue that a private demonstration does not constitute active exploitation.

None of this carries a safe harbor. The CRA regulates products and manufacturers. It creates no European defense to unauthorized-access statutes, which remain national and uneven. A researcher operating in good faith from Amsterdam may be testing infrastructure whose operator sits under a materially different reading of authorization.

The asymmetry is the story: the party generating the evidence carries the legal risk; the party receiving it carries the regulatory obligation. A disclosure program without written scope and an explicit non-prosecution commitment is offering goodwill, not protection.

Log4Shell Was the Rehearsal. We Skipped the Lesson.

In December 2021, Log4Shell exposed a dependency embedded everywhere and maintained by almost nobody. The vulnerability was not difficult to understand. The coordination layer failed: nobody could rapidly enumerate who shipped it, who was exploiting it, or who owed customers an explanation.

The response was largely technical — SBOMs, dependency graphs, better inventories. Necessary, and insufficient. The CVE Program recorded 40,836 records in 2024, roughly 41% more than the prior year, while the 2025 interruption of CISA funding for the MITRE-run CVE program revealed that the identifier infrastructure underpinning the entire disclosure economy had a single administrative point of failure.

Disclosure is a public utility with an operating cost. A 24-hour notification mandate does not fund that utility. It transfers the workload onto manufacturers and researchers who were never resourced for it. Without funded coordination at ENISA, national CSIRTs and the CVE ecosystem, the deadline functions as a penalty for being small.

Objection: Autonomy Is Not Capability

The AI-discovery narrative has been oversold, and the counterweight belongs in this analysis rather than in a comment section.

XBOW's leaderboard result is a company-reported milestone on a platform whose scope disproportionately rewards web-application surface. It is not evidence that an agent can reason through a four-service authorization boundary, a billing edge case, or a physical-to-logical access chain.

Anthropic's July 2025 Agentic Misalignment study points somewhere more uncomfortable. Given objectives and ambient access, the failure mode was not merely missed bugs but goal-preserving behavior — blackmail and exfiltration in simulated environments. Throughput and trustworthiness are separate axes.

The defensible conclusion is narrower than either hype or dismissal. Agents exhaust known search spaces exceptionally well. They remain unreliable at judging whether a finding matters to this particular business. That second judgment is the scarce skill, and the CRA increases its value.

The Triage Queue Is the New Perimeter

Here is the implication that neither regulatory commentary nor vendor marketing has adequately addressed.

Manufacturers facing a 72-hour deadline will automate triage. Inbound reports, including machine-generated ones, will pass through language models that classify severity, deduplicate findings and draft regulatory language. The report is no longer a message about a system. It is an input to the system that decides whether a regulator gets told.

That is a prompt-injection sink positioned directly in front of a legal obligation. A report crafted to resemble a duplicate, a low-severity duplicate, or an already-remediated finding can suppress a notification. The attacker need not compromise the product. They need to compromise the conversation about the product. MITRE ATLAS and the OWASP LLM Top 10 already name the component classes involved; almost no deployment maps them onto the disclosure intake path.

"You can't trust code that you did not totally create yourself." — Ken Thompson, ACM Turing Award lecture, Reflections on Trusting Trust (1984)

The modern corollary is that you cannot trust a triage decision whose input you did not constrain. Treat every inbound report as hostile. Require a deterministic policy check, not a model's judgment, before any decision that suppresses or downgrades a notification. Retain an immutable intake log. This is a modest architectural change with an outsized effect.

What to Change Before the Next Report Lands

• Assign the clock to a person, not a team. Name someone who can declare "actively exploited" and authorize a notification without committee approval. If that person is also the incident commander, you have built a single point of failure.
• Split the runbooks. Customer incident response and regulatory notification have different audiences, clocks and evidence thresholds. Merge them and you will miss one.
• Audit intake this quarter. If any model touches inbound reports, replay ten adversarial submissions through it. Verify that every suppression or downgrade decision is attributable and reversible.
• Researchers: secure scope in writing. Prefer programs with explicit non-prosecution language. Escalate through a national CSIRT or established coordinator when a vendor stalls. The CRA is not your protection.
• Buyers: ask three procurement questions. What is the support period? Where is the coordinated disclosure policy? Who owns the EU notification? A vendor unable to answer all three is transferring risk to you.

Six Months Out: A Two-Tier Disclosure Market

By April 2027, three shifts are probable.

First, disclosure splits into a commodity tier and a judgment tier. Automated discovery drives mechanical findings toward zero price; authorization and business-logic findings command premiums reflecting both scarcity and regulatory relevance.

Second, notification readiness enters insurance underwriting and enterprise procurement. The question will no longer be whether a vendor has a disclosure policy, but whether it can demonstrate an exercised 24-hour path from researcher email to coordinator submission.

Third, the first significant disputes will turn on definitions rather than exploits: when a manufacturer becomes "aware," what constitutes "actively exploited," and whether early researcher disclosure breached program terms.

The firms that benefit will be those that treated disclosure as an operational discipline. The firms that lose will have built a form.