Google pauses open source bug bounty program after flood of AI reports

Google has paused its Open Source Software Vulnerability Rewards Program, a bug bounty system that pays outside researchers for finding and reporting vulnerabilities in the company’s open source software. The freeze took effect October 1, and Google says it will provide an update on the program’s status in the first quarter of 2027. The initiative is one of several bug bounty programs Google operates; this one covers code the company maintains or contributes to publicly, separate from its programs for other products.

The company announced the pause in posts on X and on the program’s website, citing a surge in reports generated by automated tools. “This pause is due to a significant rise in automated submissions, the vast majority of which are not valid,” Google said in its announcement.

According to Tom’s Hardware, the influx of low-quality reports had overwhelmed Google engineers and the open source maintainers who review submissions, many of them unpaid volunteers. Tom’s Hardware reported that a number of the submissions contained hallucinations, meaning fabricated vulnerabilities that do not actually exist but were written up with convincing technical detail by AI tools.

The issue is not new to the industry. TechCrunch reported last year that cybersecurity experts were already warning that AI-generated “slop” reports threatened bug bounty programs broadly, since a reviewer often cannot tell a fabricated report from a genuine one without spending time investigating the underlying claim. Google’s pause suggests that volume has now outpaced what a review process built around engineers and volunteer maintainers can sustain.

Google has not said how many reports the open source program received before the freeze, what portion were AI-generated, or what changes it might make before resuming the program. In the meantime, the company is pointing researchers who want to keep submitting findings toward its other bug bounty programs, which remain active and cover different parts of its products and infrastructure rather than its open source code specifically.

The next concrete marker is Google’s promised update in the first quarter of 2027, which should say whether the open source program resumes, changes its review process, or is replaced entirely. Until then, researchers who focus on Google’s open source projects have no bounty program to submit findings to, and the broader bug bounty industry is left watching whether other companies facing the same flood of automated submissions choose to follow Google’s approach and pause their own programs rather than keep absorbing the review burden.