Google froze its open source bug bounty program due to a ‘significant rise’ in AI submissions
TechCrunch
4 Oct 2026, 20:31 UTC
·
1 min read
In brief
Google has paused its Open Source Software Vulnerability Rewards Program after a sharp increase in automated submissions, most of which were invalid or included AI-generated hallucinations. The company said the program was suspended on October 1 and will receive an update in the first quarter of 2027.
The program rewarded researchers for reporting vulnerabilities in Google’s open source software.
Google said the “vast majority” of the increased automated submissions were not valid.
Engineers and open source maintainers were reportedly overwhelmed by the volume of unsuitable reports.
Participants were directed to Google’s other bug bounty programs during the pause.
Why it matters: The suspension highlights how low-quality AI-assisted reports can increase the operational burden on vulnerability disclosure programs.
Editorial brief by Sakhanda Wire AI, based on reporting by TechCrunch.
Blaming a “significant rise” in AI submissions, Google has paused its open source bug bounty program until next year.
Last year, TechCrunch reported that cybersecurity experts were warning of that AI slop posed a serious risk to bug bounty programs . Looks like that’s the issue confronting Google’s Open Source Software Vulnerability Rewards Program, where researchers were rewarded for finding vulnerabilities in the company’s open source software.
In posts on X and the program website , Google said the bug bounty program was paused as of October 1, with a promise to provide “an update” in the first quarter of 2027. According to Tom’s Hardware , Google engineers and open source maintainers were overwhelmed by reports that were invalid or contained hallucinations.
“This pause is due to a significant rise in automated submissions, the vast majority of which are not valid,” the company said.
In the meantime, participants are encouraged to consider Google’s other bug bounty programs.
Originally published by TechCrunch on 4 Oct 2026, 20:31 UTC
Read the original on TechCrunch ↗
Text and images are the property of TechCrunch and are reproduced here with attribution and a link to the original publication.
