Google suspends open‑source bug bounty program amid surge in AI submissions
google open-source
| Source: TechCrunch | Original article
Google has paused its open source bug bounty program until next year, citing a significant increase in AI‑related submissions that are overwhelming the system.
Google has halted its Open Source Software Vulnerability Rewards Program (OSS VRP) effective 1 October, citing a “significant rise” in AI‑generated bug submissions that have overwhelmed engineers and open‑source maintainers. The company announced the pause on X and on the program’s website, adding that it will not accept new product‑vulnerability reports until the program is relaunched next year, with an update promised in the first quarter of 2027.
The surge of AI‑driven reports, many of which were invalid or contained hallucinated vulnerabilities, has rendered the bounty workflow unmanageable. Google’s internal teams found they were spending disproportionate effort triaging false positives, diverting resources from genuine security work. The move underscores a growing tension between the promise of AI‑assisted security testing and the practical challenges of filtering low‑quality output at scale.
The suspension matters because the OSS VRP has been a key channel for identifying flaws in widely used open‑source components that underpin Google’s services and the broader internet. A prolonged gap could leave critical codebases less scrutinised, potentially increasing exposure to real exploits. At the same time, the episode highlights the need for more robust validation mechanisms for AI‑generated security reports across the industry.
Watch for Google’s Q1 2027 briefing, which should outline how the company plans to redesign the program—whether through stricter submission filters, new AI‑verification tools, or revised reward structures. The broader security community is also likely to debate standards for AI‑assisted bug bounty submissions, a conversation that could reshape how open‑source projects manage vulnerability disclosures in an increasingly automated world.
Sources
Back to AIPULSEN