Blaming a significant and unsustainable rise in automated entries, tech giant Google has officially paused its open source bug bounty program until next year. The suspension highlights a growing crisis across the cybersecurity industry, where the democratization of generative artificial intelligence has inadvertently created massive operational hurdles for software maintainers and security teams.
The disruption directly impacts Google’s Open Source Software Vulnerability Rewards Program, an initiative designed to financially reward security researchers and developers who discover and responsibly disclose genuine vulnerabilities within the company’s vast ecosystem of open source software. According to official announcements posted by Google on social media platform X and updated guidelines on the official program website, the suspension took effect on October 1. The company has promised to provide a formal update regarding the future and restructuring of the initiative in the first quarter of 2027.
The decision to hit the pause button was not made lightly, but engineering teams and project maintainers were left with little choice. Industry reporting from outlets like Tom’s Hardware indicates that internal Google engineers and external open source maintainers were completely overwhelmed by an unprecedented wave of reports that proved to be entirely invalid or heavily laden with artificial intelligence hallucinations.
In a brief yet telling statement regarding the operational bottleneck, Google explained the rationale behind the sudden halt to the program. This pause is due to a significant rise in automated submissions, the vast majority of which are not valid, the company noted, capturing the frustration felt by security professionals dealing with low-effort, high-volume noise generated by automated tools.
This modern dilemma has been brewing for some time, as the cybersecurity community has watched generative artificial intelligence tools transform from helpful assistant technologies into engines of widespread digital pollution. Last year, industry reporting highlighted that cybersecurity experts were already issuing stern warnings that artificial intelligence slop and fake vulnerability reports posed a serious and escalating risk to traditional bug bounty programs across the entire tech sector.
Bug bounty programs have long relied on a symbiotic relationship between tech companies and independent researchers, often referred to as white-hat hackers. Companies offer financial rewards, or bounties, as an incentive for finding complex security flaws that automated scanning tools might miss. However, the advent of accessible large language models and automated script generation has lowered the barrier to entry to an extreme degree. Individuals with little to no security background can now prompt artificial intelligence tools to churn out plausible-sounding vulnerability reports en masse, attempting to cash in on corporate reward pools without doing the rigorous, manual verification work required in professional cybersecurity research.
The consequence of this shift is a profound administrative and technical burden. Security teams that should be spending their time patching zero-day vulnerabilities, hardening source code, and investigating credible threats are instead spending countless hours wading through mountains of garbage data. When AI models hallucinate vulnerabilities—inventing non-existent software flaws, misinterpreting codebases, or reporting issues that have already been fixed—they create a phantom workload that exhausts human reviewers.
Google’s decision to temporarily suspend the open source segment of its vulnerability rewards program reflects a broader reckoning that technology platforms must face. Without robust filtration mechanisms or stronger disincentives against low-quality submissions, the very programs meant to secure open source software risk collapsing under the sheer weight of automated noise.
While the Open Source Software Vulnerability Rewards Program is currently frozen, Google has not completely closed its doors to the security research community. In the meantime, participants who discover legitimate, verified vulnerabilities are encouraged to consider Google’s other bug bounty programs, which cover different aspects of the company’s massive product portfolio and may employ different submission controls or screening processes to manage the influx of incoming reports.