Google Freezes Open Source Bug Bounty Over AI Submissions — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Google paused its Open Source Software Vulnerability Rewards Program as of October 1, citing a "significant rise" in automated AI submissions and promising an update in Q1 2027.
- Tom's Hardware reported that Google engineers and open source maintainers were overwhelmed by reports that were invalid or contained AI-generated hallucinations.
- Google stated that "the vast majority" of the automated submissions were not valid, per its posts on the program website and X.
- During the pause, Google is redirecting participants to consider its other bug bounty programs.
- Last year's TechCrunch reporting had cited cybersecurity experts warning that AI slop posed a serious risk to bug bounty programs — the same problem now confronting Google.
Why it matters: Google's freeze leaves a gap in incentivized vulnerability research on its open source software through Q1 2027 — a more than year-long pause — while the company redirects participants to other programs it runs rather than fixing its filtering. The episode validates last year's warnings from cybersecurity experts that AI-generated noise was overwhelming bug bounty programs, and researchers who relied on this pipeline face no Google compensation for open source work until 2027.
Ask SkimNews
