Google Pauses Bug Bounty Program After Surge in AI-Generated Reports Overwhelms Security Teams
10 Sources
[1]
Google froze its open source bug bounty program due to a 'significant rise' in AI submissions
Blaming a "significant rise" in AI submissions, Google has paused its open source bug bounty program until next year. Last year, TechCrunch reported that cybersecurity experts were warning of that AI slop posed a serious risk to bug bounty programs. Looks like that's the issue confronting Google's
[2]
Google halts open-source bug bounty program amid AI spam surge
Google has now suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after being flooded by AI-generated reports. The company's OSS VRP incentivizes security researchers to responsibly disclose security flaws across open-source projects maintained by Google,
[3]
Google pauses bug bounties for open source because AI slop reports are drowning its reviewers
Serving tech enthusiasts for over 25 years. TechSpot means tech analysis and advice you can trust. Security slop: Generative AI models are exceptionally good at working with code, and vibe coding is now spilling over everywhere. So much so, in fact, that many open-source projects are struggling
[4]
Google praised AI for finding bugs. Now it has too many reports, not enough bugs
The timing is hard to ignore: Google has spent much of 2026 praising AI for making bug hunting faster, easier, and far more productive. Google has been doing a pretty good job of showing off what AI can do for software security. Its AI agents are finding bugs humans missed, uncovering
[5]
Google benches open source bug bounty program following 'significant rise' in AI submissions
* Google paused OSS bug bounty submissions after a surge of AI-generated, invalid reports * AI boosts vulnerability discovery but often produces flawed, incomplete, or hallucinatory findings * Rising AI-driven bounty spam has also overwhelmed curl maintainers and Linux security reviewers Google
[6]
Google pauses its open-source bug bounty program after a flood of AI slop reports
Google has suspended product vulnerability submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP), citing a flood of low-quality, AI-generated reports that its team could no longer keep up with. The pause took effect on October 1 and will run until at least the first
[7]
Google pauses open-source bug bounty program over invalid AI reports
Google has paused its open-source software bug bounty program, citing a "significant rise" in automated AI-related submissions, most of which were invalid. The company said in posts on X and the program website that the pause took effect on October 1. It promised to provide "an update" in the
[8]
Google Is Pausing a Lucrative Bounty Hunter Program. The Reason Points to a Weakness With Using AI
Google has paused its open-source software bug bounty program. The reason? AI slop. Google Vulnerability Reward Program announced the update on social media platform X last week, noting the program would "temporarily" no longer accept submissions. The update comes as AI has accelerated the pace
[9]
AI churns out bug reports faster than Google can verify them - MEDIANAMA
On October 1, Google paused its program that compensates external researchers for identifying security flaws in its open-source projects. TechCrunch reported that Google has paused its Open Source Software Vulnerability Reward Program (OSS VRP) due to a significant increase in automated
[10]
Why Google Paused Its Open-Source Bug Bounty Program Amid AI-Generated Submissions
Google has paused its open-source bug bounty program, and the move shows how AI is changing security work. The company stopped taking new product vulnerability reports for its Open Source Software Vulnerability Reward Program (OSS VRP) on October 1, 2026. Reviewers faced a flood of AI-generated bug
Share
Copy Link
Google has suspended its Open Source Software Vulnerability Rewards Program following an overwhelming flood of AI-generated bug reports. The pause affects submissions as of October 1, 2026, with the company promising updates in Q1 2027 as it works to address automated submission issues plaguing vulnerability reporting systems.
Google Halts Bug Bounty Program Amid AI Submissions Crisis
Google has paused its Open Source Software Vulnerability Rewards Program (OSS VRP) effective October 1, 2026, citing a significant rise in automated submissions that have overwhelmed its security review teams
1
2
. The program, which incentivizes security researchers to responsibly disclose vulnerabilities across Google's open-source projects including Golang, Angular, Bazel, Protocol Buffers, and Fuchsia, has become unmanageable due to the vast majority of AI-generated bug reports being invalid3
. Google engineers and open-source maintainers found themselves drowning in reports containing hallucinations and invalid information, forcing the company to temporarily stop accepting product vulnerability submissions while continuing to process reports filed before the cutoff date2
.
Source: MediaNama
The Irony of AI in Security Research
The timing presents a striking contradiction. Throughout 2026, Google has championed AI as a breakthrough for cybersecurity, showcasing tools like its PageBreak agent that uncovered over 500 cross-site scripting vulnerabilities across Google's web applications
4
. The company's internal AI agents scan hundreds of millions of lines of infrastructure code, reportedly preventing hundreds of vulnerabilities monthly. Yet this same technology has now created an untenable situation where Google must pause bug bounty program submissions because the volume of AI-generated reports has exceeded human review capacity4
. Many automated submissions identify genuine coding mistakes like buffer overflows but in unreachable code or contexts with minimal security impact, creating noise rather than actionable intelligence5
.Industry-Wide Vulnerability Management Systems Under Strain
Google isn't alone in confronting AI spam overwhelming vulnerability reporting channels. In January 2026, the maintainer of curl ended the project's HackerOne bug bounty program after being flooded with fake problems and vulnerabilities generated by AI
2
5
. Linux kernel maintainer Linus Torvalds declared the security mailing list "almost entirely unmanageable" in May 2026, with researchers using generative AI tools to flood it with duplicate reports5
. Intel removed all financial rewards from its Intigriti bug bounty program in September, though the company hasn't explained its reasoning2
. Microsoft warned in May that AI tools surfacing more vulnerabilities would increase operational demands across the software industry, a prediction validated when the company patched a record-breaking 966 flaws in September 20262
.
Source: TechSpot
Related Stories
Quality Concerns in AI-Generated Security Findings
Research from 1Password's Off-by-1 Labs in August revealed fundamental limitations in AI-generated security patches. The study found that 49.3% of AI-produced patches failed to fix at least one existing exploit path, while 20.1% fixed the original issue but altered application behavior
5
. More concerning, 2.3% introduced new security issues, and 2.2% both failed to address the vulnerability while creating additional exploit paths. Missing context emerged as the primary challenge, with AI producing significantly better results only when provided proper background information5
. This quality gap explains why invalid bug reports now dominate Google's OSS VRP submissions, despite researchers investing minimal effort in analysis and oversight.What Happens Next for Bug Bounty Programs
Google commits to providing an update on the reformatted OSS VRP in Q1 2027, though the company hasn't detailed specific changes to address automated submission issues
1
3
. The pause bug bounty program decision doesn't affect OSS VRP supply chain reports or outstanding submissions filed before October 12
. Researchers can still pursue rewards through Google's other vulnerability reward programs and the Google Patch Rewards Program, which offers up to $15,000 for high-impact fixes2
. Since launching its first VRP in 2010, Google has awarded over $81.6 million to security researchers, including a record $17.1 million to more than 700 researchers in 2025, representing a 40% increase from the $12 million awarded in 20242
. GrapheneOS warns that Google has become "completely overwhelmed" by vulnerabilities discovered by AI models both internally and externally, affecting how Android security fixes are handled and backported4
. The industry now faces a critical question: how to harness AI's vulnerability discovery capabilities while filtering out the noise that threatens to collapse the very systems designed to improve software security.References
Summarized by
Navi
[1]
[2]
[3]
[4]
Related Stories
Apple Caps Bug Bounty Submissions as AI Bug Reports Overwhelm Security Teams
02 Aug 2026•Technology
Google Launches Dedicated AI Bug Bounty Program with Rewards up to $30,000
06 Oct 2025•Technology
cURL scraps bug bounties as AI slop overwhelms security team with fake vulnerability reports
23 Jan 2026•Technology
Recent Highlights
1
OpenAI's AI Models Disprove 27-Year Exponential Time Hypothesis, Rendering Decades of Research Obsolete
Science and Research
2
Google DeepMind unveils Genie 4 world model with audio and 2-minute interactive simulations
Technology
3
OpenAI Cuts Internet Access for AI Model Training After Security Breaches
Technology
Recent Highlights
Today's Top Stories
Don’t drown in AI news. We cut through the noise - filtering, ranking and summarizing the most important AI news, breakthroughs and research daily. Follow topics that matter to you and stay ahead.
