Blaming a significant rise in automated submissions, Google has officially paused its open source bug bounty program until next year, joining a growing list of technology organizations grappling with the administrative fallout of generative artificial intelligence tools.
Last year, cybersecurity experts warned that AI slop posed a serious risk to bug bounty programs, a prediction that now appears to be manifesting within Google’s own infrastructure. The challenge has directly confronted Google’s Open Source Software Vulnerability Rewards Program, an initiative designed to reward independent security researchers for identifying and responsibly disclosing vulnerabilities in the company’s vast ecosystem of open source software projects.
According to updates posted by Google on social media and its official program website, the bug bounty initiative was suspended effective October 1. The company has promised to provide an update regarding the future of the program in the first quarter of 2027. Industry reporting indicates that Google engineers and the maintainers of various open source projects have been completely overwhelmed by a wave of incoming reports that either lack validity or are riddled with AI-generated hallucinations.
In a statement addressing the suspension, the company pointed directly to the root cause of the operational bottleneck. This pause is due to a significant rise in automated submissions, the vast majority of which are not valid, the company said.
The phenomenon of AI-generated bug reports has become an increasingly pressing concern across the cybersecurity industry. Security researchers and platform administrators alike have noted that low-barrier generative tools allow individuals—ranging from opportunistic bounty hunters to automated scripts—to churn out vast quantities of speculative vulnerability reports with minimal human oversight. These submissions often rely on superficial analysis, misunderstanding complex codebases, or generating entirely fictitious security flaws that require manual verification by human security professionals.
For maintainers of open source software, who often operate on limited budgets or as volunteer contributors, parsing through streams of invalid or hallucinated reports represents an unsustainable drain on time and resources. Rather than improving security posture, the influx of automated noise threatens to obscure genuine security threats reported by skilled researchers, ultimately undermining the core purpose of bug bounty programs.
While the Open Source Software Vulnerability Rewards Program remains temporarily offline, Google has indicated that researchers looking to contribute valid security insights are welcome to explore the company’s other active bug bounty programs. These alternative avenues continue to operate as Google assesses how to effectively filter out low-quality automated noise and adapt its review processes for the realities of the modern AI landscape.
Leave a Reply