AI Slop Just Broke Googles Open Source Bug Bounty Program
Google has paused its Open Source Software Vulnerability Rewards Program until at least Q1 2027, citing a "significant rise" in automated AI-generated vulnerability reports, most of them invalid, joining curl and Intel in scaling back bug bounties overwhelmed by low-quality AI submissions.
The same AI boom Google helped build just broke one of its own security programs. The company confirmed it has paused its Open Source Software Vulnerability Rewards Program, effective October 1, blaming what it called a "significant rise in automated submissions, the vast majority of which are not valid."
The program had spent years rewarding researchers for responsibly disclosing real flaws across Google's open-source code — Golang, Angular, Bazel and more. What changed is the flood of reports that look professionally written but describe bugs that simply don't exist. A few details show how bad the problem had gotten:
- According to Tom's Hardware, Google engineers and open-source maintainers were overwhelmed by reports that were "invalid or contained hallucinations" — AI confidently describing vulnerabilities that were never actually there
- The pause covers product vulnerability submissions specifically, while supply-chain reports and anything already submitted remain unaffected
- Google says it will provide "an update" in the first quarter of 2027, with no firm restart date announced
Google is far from the first to hit this wall. The maintainer of curl ended its HackerOne bounty program back in January after a similar flood of AI slop, and Intel's own Intigriti bug bounty quietly stopped offering payouts for the same reason.
As Malwarebytes put it, the underlying problem is structural: "Bounties can be an incentive for mass-submitting behavior when generative AI lowers the cost of producing polished-looking submissions" — when writing a report costs nothing, flooding the system with plausible-sounding nonsense becomes the path of least resistance.
The real tension Google now has to solve isn't whether AI-assisted reports should be allowed at all — a genuinely valid finding can still come from an AI-assisted search — but how to filter signal from noise fast enough that legitimate researchers don't get buried under the same wave that just sank the whole program.
