Google halts open-source bug bounties after AI-generated flood
Google has suspended its Open Source Software Vulnerability Rewards Program effective October 1, citing a surge in automated submissions that are largely invalid. The company plans to provide an update in the first quarter of 2027.
AI slop overwhelms triage
Cybersecurity experts warned last year that large language models would pollute bug bounty pipelines. That prediction has materialized. Google engineers and open-source maintainers report being swamped by reports that contain hallucinated vulnerabilities or fail to reproduce. The vast majority of recent submissions were generated by AI tools and do not represent real security issues.
Program scope and rewards
The paused program covers vulnerabilities in Google's open-source projects. Researchers who discovered legitimate flaws received monetary rewards. The suspension does not affect Google's other bug bounty programs, which remain open for submissions.
Operational impact
Triage teams must now filter a high-volume stream of low-quality reports before reaching legitimate findings. Each invalid submission consumes reviewer time that would otherwise go to genuine vulnerabilities. The pause allows Google to redesign the intake and validation process without the current noise floor.
Broader signal for the industry
Google's move follows similar pressures on other public bounty platforms. As AI-assisted vulnerability discovery becomes trivial to automate, the signal-to-noise ratio in open disclosure channels is collapsing. Programs that lack automated filtering or reputation gating will face the same choice: pause, restrict access, or drown in slop.
Participants are directed to Google's remaining bounty programs while the open-source track is retooled.