# Hotcrp.com – AI agents and bot accounts

> Source: <https://hotcrp.com/news/2026/ai-agents-202608>
> Published: 2026-08-22 16:46:22+00:00

# AI agents and bot accounts

**19 August 2026** — HotCRP.com sites can now be connected to AI agents. If
conference administrators allow it, bot accounts can read submissions, set tags,
and write reviews, and PC members can connect agents that work on their behalf.

Agents connect over [MCP](https://modelcontextprotocol.io/), the protocol that
[Claude](https://claude.ai), Claude Code, and other clients use to reach outside
services. Agents can currently search submissions, read reviews, comments, and
submitted documents, set tags, and write reviews and comments.

AI agent support is disabled by default. It can be enabled using Settings >
AI on all HotCRP.com sites, including [test sites](https://test.hotcrp.com/).

## Security and risks

HotCRP sends nothing to any AI service on its own, and connecting an agent is never automatic. But once connected, the submissions, reviews, and reviewer identities read by an agent are sent to the service that runs the agent. Whether the service keeps the data, trains on it, or exposes it to others is between the service operator and the person who authorized the connection. HotCRP doesn’t control that, and a conference’s promise of confidentiality to its authors and reviewers does not automatically extend to AI services.

Sponsors and conferences differ on whether confidential submissions may be sent to third-party services at all, and some forbid it. Check your sponsor’s policy before enabling agents.

Note that most AI services have settings that govern how conversations are retained and used. Defaults differ by vendor and by plan, and business plans often differ from personal plans. It’s not always easy to control these settings. Conferences concerned about agent confidentiality should limit AI agent use to administrators.

Submissions and reviews might also contain text aimed at agents rather than
humans. A paper can contain instructions; an agent that can write may be induced
to follow them. [Scopes](#scopes) bound the damage a rogue agent can do, and
changes made by agents are logged.

## Scopes

AI agent permissions are governed by **permission scopes** set at authorization
time. A scope limits a credential’s rights. The `read`

scope, for example,
allows reading, but not writing; an agent with `read`

scope is prevented from
modifying conference data. Scopes can also name submissions: the `read#10`

scope
allows an agent to read submission #10 (including reviews and comments), and
nothing else; `read#agent`

lets it read submissions with tag #agent, and
`read?q=dec:yes`

lets it read accepted submissions. (Specifically, it can read
those submissions whose acceptance status the connected user can see: scopes do
not expose information the connected user couldn’t otherwise view.)

If a PC member loses a role, or a conference narrows who may use agents, the associated credentials stop working. Users can see and revoke their own agents under Profile > Developer.

Scopes relevant for agents include `submeta:read`

(submission fields),
`document:read`

(PDFs), `tag:read`

, `review:read`

, `comment:read`

, `tag:write`

,
`review:write`

, and `comment:write`

. A scope like `paper:read`

grants all of
`submeta`

, `document`

, `tag`

, `review`

, and `comment`

.

## Bot accounts

Administrators can create and manage bot accounts designed for agent use. Bots are typically unlisted PC members, with PC rights; they can be assigned reviews, for example. Unlike other accounts:

- Bots sign in
**only as authorized by conference administrators** using API tokens or OAuth authorization. - Bots are
**never anonymous** and they are explicitly identified as AI.

Create bots under Settings > AI.

## Conclusion

AI review is new to our community. Conferences want different things, and the
set of site features available to agents is still expanding. Please email me
with questions, ideas, and bugs, or [use
GitHub](https://github.com/kohler/hotcrp) to create issues.

— Eddie Kohler