Google pauses open-source bug bounty program after AI-generated submissions overwhelm reviewers
Published · updated · curated by AI Is Going Just Great
Source: techcrunch.com ↗
"This pause is due to a significant rise in automated submissions, the vast majority of which are not valid."
Google's Open Source Software Vulnerability Rewards Program went dark on October 1, 2026, after a flood of AI-generated bug reports buried the engineers meant to evaluate them. The company cited "a significant rise in automated submissions, the vast majority of which are not valid" — a polished way of saying researchers were drowning in hallucinated vulnerability reports. The program will stay paused until at least Q1 2027.
Cybersecurity experts had been warning about AI slop in bug bounty programs for at least a year before Google pulled the plug. Participants are now pointed toward Google's other bounty programs, which presumably have not yet been colonized by confident, incorrect AI agents.