Google Pauses Open Source Bug Bounty Program Over Flood of AI-Generated Submissions
Google suspended its Open Source Software Vulnerability Rewards Program on October 1 after engineers and maintainers were overwhelmed by a surge of automated reports that were mostly invalid or hallucinated. An update is promised in Q1 2027.
Google has paused its Open Source Software Vulnerability Rewards Program, citing a surge in automated, largely invalid submissions it attributes to AI-generated content. The pause took effect on October 1, 2026, with the company promising an update in the first quarter of 2027.
The program, which rewarded researchers for identifying security vulnerabilities in Google’s open source software, was suspended after Google engineers and open source maintainers were overwhelmed by reports deemed invalid or containing hallucinations — errors characteristic of AI-generated output.
“This pause is due to a significant rise in automated submissions, the vast majority of which are not valid,” Google said in posts on X and the program’s official website.
The development follows warnings that had already been circulating in the cybersecurity community. TechCrunch previously reported that experts cautioned AI-generated “slop” posed a serious risk to bug bounty programs — a concern that now appears to have materialized for Google’s open source initiative.
While the program is on hold, Google is encouraging participants to explore its other active bug bounty programs in the meantime.
The situation suggests that the rise of accessible AI tools may be creating new operational challenges for vulnerability reward programs, as the volume of low-quality, machine-generated reports could make it harder for security teams to identify legitimate findings among the noise.