Google Pauses Open Source Bug Bounty Program Amid Flood of Invalid AI Submissions

Blaming a significant and unsustainable rise in low-quality automated entries, tech giant Google has officially paused its open source bug bounty program, effectively halting the acceptance of new vulnerability reports until early next year.

The suspension, which took effect on October 1, targets the company’s Open Source Software Vulnerability Rewards Program (OSS VRP). This specialized initiative has historically rewarded security researchers, developers, and independent analysts for discovering, verifying, and responsibly disclosing genuine security flaws across Google’s wide-ranging ecosystem of open-source projects.

According to updates published by the company on social media platform X and confirmed through official channels on the program’s website, the temporary shutdown is a direct response to a massive influx of invalid and low-quality reports. Google engineers, security personnel, and open-source project maintainers have reportedly been overwhelmed by a tidal wave of automated submissions, many of which contain severe hallucinations, non-existent vulnerabilities, or entirely fabricated security concerns generated by artificial intelligence tools.

"This pause is due to a significant rise in automated submissions, the vast majority of which are not valid," the company stated in its official communication regarding the suspension.

Industry observers note that this development marks a critical turning point for the cybersecurity sector, validating long-standing concerns regarding the unintended consequences of generative AI tools. Last year, cybersecurity experts warned that the proliferation of easily accessible AI models could lead to a severe operational bottleneck across the vulnerability disclosure landscape. Analysts pointed out that malicious actors, opportunistic individuals, and script-kiddies were increasingly leveraging AI systems to churn out automated vulnerability reports in hopes of securing financial payouts, completely bypassing the rigorous manual testing required to validate actual security software flaws.

Those warnings appear to have materialized within Google’s open-source reward initiative. Tom’s Hardware reported that the sheer volume of AI-generated noise has severely hampered the productivity of security teams, forcing engineers to spend an inordinate amount of time filtering through useless submissions rather than addressing legitimate cyber threats. The burden has fallen disproportionately on open-source maintainers, who often volunteer their time to oversee critical software components utilized by developers worldwide.

Despite the temporary closure of the open-source software reward track, Google has indicated that the pause is not indefinite. The company has promised to provide a comprehensive update regarding the future and potential restructuring of the program in the first quarter of 2027. During the interim period, security researchers and ethical hackers who regularly contribute to Google’s security posture are being encouraged to pivot their efforts toward the company’s alternative bug bounty programs, which remain operational while security teams evaluate how to better handle the automated submission crisis.