Google halts open source bug bounty program after AI-generated submissions surge

Google announced it is temporarily shutting down its Open Source Software Vulnerability Rewards Program, effective October 1st, amid an unprecedented flood of unreliable submissions. The pause follows a pattern of degraded signal-to-noise that has made it harder for the company and open source maintainers to evaluate legitimate security findings.

The AI submissions problem#

The core issue stems from an explosion of invalid reports—many generated by AI tools—that contain errors, false positives, and hallucinations. Rather than carefully crafted vulnerability disclosures, researchers and program administrators have been processing vast numbers of automated submissions that waste their time without yielding actionable security intelligence. Google acknowledged this directly, noting that "a significant rise in automated submissions, the vast majority of which are not valid" forced the suspension.

This echoes warnings that emerged earlier from the security community. As TechCrunch previously reported, cybersecurity experts flagged the danger of AI-generated content overwhelming bug bounty initiatives, drowning out genuine research.

Timeline and alternatives#

Google has indicated the pause will remain in effect until the first quarter of 2027, when the company plans to provide more details. Researchers interested in contributing security findings are being directed toward Google's other bug bounty initiatives in the interim, which have not been suspended.

The move reflects a growing challenge across the security industry: as AI tools proliferate, organizations must find ways to filter legitimate reports from the flood of machine-generated noise.