Google Suspends Open Source Bug Bounty Program Following Surge in Invalid AI-Generated Submissions

TechCrunch•Published: Oct 5, 2026 02:01 AM IST

Google has officially paused its Open Source Software Vulnerability Rewards Program effective October 1, citing an unmanageable influx of low-quality submissions. The company reported that the vast majority of recent reports were invalid or contained AI-generated hallucinations, overwhelming the engineers and maintainers responsible for reviewing them.

Program Suspension: The bug bounty initiative is currently inactive, with Google promising a formal update on the program's status in the first quarter of 2027.
AI-Generated Spam: The surge in submissions is attributed to automated tools producing "AI slop," which has created a significant administrative burden for security teams.
Reviewer Overload: Google engineers and open source maintainers were unable to process the volume of reports, most of which lacked technical validity or accuracy.

The Context & Background

This decision follows growing warnings from cybersecurity experts regarding the impact of AI-generated content on vulnerability disclosure platforms. The move highlights the broader challenge tech companies face in filtering automated noise from legitimate security research.

Why it matters:This pause underscores a critical turning point in cybersecurity where AI-driven automation threatens to degrade the efficacy of crowdsourced security programs. By forcing a halt to operations, Google highlights the urgent need for better filtering mechanisms to ensure that human security researchers can continue to report genuine vulnerabilities without being drowned out by AI-generated noise.

Enjoyed this 2-minute breakdown?

Share it with your colleagues and friends!