AI agents and bot accounts
19 August 2026 — HotCRP.com sites can now be connected to AI agents. If conference administrators allow it, bot accounts can read submissions, set tags, and write reviews, and PC members can connect agents that work on their behalf.
Agents connect over MCP, the protocol that Claude, Claude Code, and other clients use to reach outside services. Agents can currently search submissions, read reviews, comments, and submitted documents, set tags, and write reviews and comments.
AI agent support is disabled by default. It can be enabled using Settings > AI on all HotCRP.com sites, including test sites.
Security and risks
HotCRP sends nothing to any AI service on its own, and connecting an agent is never automatic. But once connected, the submissions, reviews, and reviewer identities read by an agent are sent to the service that runs the agent. Whether the service keeps the data, trains on it, or exposes it to others is between the service operator and the person who authorized the connection. HotCRP doesn’t control that, and a conference’s promise of confidentiality to its authors and reviewers does not automatically extend to AI services.
Sponsors and conferences differ on whether confidential submissions may be sent to third-party services at all, and some forbid it. Check your sponsor’s policy before enabling agents.
Note that most AI services have settings that govern how conversations are retained and used. Defaults differ by vendor and by plan, and business plans often differ from personal plans. It’s not always easy to control these settings. Conferences concerned about agent confidentiality should limit AI agent use to administrators.
Submissions and reviews might also contain text aimed at agents rather than humans. A paper can contain instructions; an agent that can write may be induced to follow them. Scopes bound the damage a rogue agent can do, and changes made by agents are logged.
Scopes
AI agent permissions are governed by permission scopes set at authorization
time. A scope limits a credential’s rights. The read scope, for example,
allows reading, but not writing; an agent with read scope is prevented from
modifying conference data. Scopes can also name submissions: the read#10 scope
allows an agent to read submission #10 (including reviews and comments), and
nothing else; read#agent lets it read submissions with tag #agent, and
read?q=dec:yes lets it read accepted submissions. (Specifically, it can read
those submissions whose acceptance status the connected user can see: scopes do
not expose information the connected user couldn’t otherwise view.)
If a PC member loses a role, or a conference narrows who may use agents, the associated credentials stop working. Users can see and revoke their own agents under Profile > Developer.
Scopes relevant for agents include submeta:read (submission fields),
document:read (PDFs), tag:read, review:read, comment:read, tag:write,
review:write, and comment:write. A scope like paper:read grants all of
submeta, document, tag, review, and comment.
Bot accounts
Administrators can create and manage bot accounts designed for agent use. Bots are typically unlisted PC members, with PC rights; they can be assigned reviews, for example. Unlike other accounts:
- Bots sign in only as authorized by conference administrators using API tokens or OAuth authorization.
- Bots are never anonymous and they are explicitly identified as AI.
Create bots under Settings > AI.
Conclusion
AI review is new to our community. Conferences want different things, and the set of site features available to agents is still expanding. Please email me with questions, ideas, and bugs, or use GitHub to create issues.
— Eddie Kohler