News – HotCRP.com<br>AI agents and bot accounts
19 August 2026 — HotCRP.com sites can now be connected to AI agents. If<br>conference administrators allow it, bot accounts can read submissions, set tags,<br>and write reviews, and PC members can connect agents that work on their behalf.
Agents connect over MCP, the protocol that<br>Claude, Claude Code, and other clients use to reach outside<br>services. Agents can currently search submissions, read reviews, comments, and<br>submitted documents, set tags, and write reviews and comments.
AI agent support is disabled by default. It can be enabled using Settings ><br>AI on all HotCRP.com sites, including test sites.
Security and risks
HotCRP sends nothing to any AI service on its own, and connecting an agent is<br>never automatic. But once connected, the submissions, reviews, and reviewer<br>identities read by an agent are sent to the service that runs the agent. Whether<br>the service keeps the data, trains on it, or exposes it to others is between the<br>service operator and the person who authorized the connection. HotCRP doesn’t<br>control that, and a conference’s promise of confidentiality to its authors and<br>reviewers does not automatically extend to AI services.
Sponsors and conferences differ on whether confidential submissions may be sent<br>to third-party services at all, and some forbid it. Check your sponsor’s policy<br>before enabling agents.
Note that most AI services have settings that govern how conversations are<br>retained and used. Defaults differ by vendor and by plan, and business plans<br>often differ from personal plans. It’s not always easy to control these<br>settings. Conferences concerned about agent confidentiality should limit AI<br>agent use to administrators.
Submissions and reviews might also contain text aimed at agents rather than<br>humans. A paper can contain instructions; an agent that can write may be induced<br>to follow them. Scopes bound the damage a rogue agent can do, and<br>changes made by agents are logged.
Scopes
AI agent permissions are governed by permission scopes set at authorization<br>time. A scope limits a credential’s rights. The read scope, for example,<br>allows reading, but not writing; an agent with read scope is prevented from<br>modifying conference data. Scopes can also name submissions: the read#10 scope<br>allows an agent to read submission #10 (including reviews and comments), and<br>nothing else; read#agent lets it read submissions with tag #agent, and<br>read?q=dec:yes lets it read accepted submissions. (Specifically, it can read<br>those submissions whose acceptance status the connected user can see: scopes do<br>not expose information the connected user couldn’t otherwise view.)
If a PC member loses a role, or a conference narrows who may use agents, the<br>associated credentials stop working. Users can see and revoke their own agents<br>under Profile > Developer.
Scopes relevant for agents include submeta:read (submission fields),<br>document:read (PDFs), tag:read, review:read, comment:read, tag:write,<br>review:write, and comment:write. A scope like paper:read grants all of<br>submeta, document, tag, review, and comment.
Bot accounts
Administrators can create and manage bot accounts designed for agent use. Bots<br>are typically unlisted PC members, with PC rights; they can be assigned reviews,<br>for example. Unlike other accounts:
Bots sign in only as authorized by conference administrators using API<br>tokens or OAuth authorization.
Bots are never anonymous and they are explicitly identified as AI.
Create bots under Settings > AI.
Conclusion
AI review is new to our community. Conferences want different things, and the<br>set of site features available to agents is still expanding. Please email me<br>with questions, ideas, and bugs, or use<br>GitHub to create issues.
— Eddie Kohler