Google Pauses Open-Source Bug Bounty Program Amid AI-Driven Submissions
In a noteworthy move reflecting the challenges faced by the tech industry, Google has announced a temporary halt to its open-source bug bounty program, citing an alarming escalation in automated submissions that lack legitimacy. This decision, which underscores the growing complications brought about by artificial intelligence (AI) in the vulnerability reporting landscape, highlights the need for more effective means of managing bug submissions.
As of October 6, 2026, the technology behemoth, a subsidiary of Alphabet, declared that it would no longer accept new entries to its open-source software Vulnerability Reward Program (VRP). This initiative, known as Google Bug Hunters, was originally designed to incentivize external security researchers and commend their efforts in identifying serious vulnerabilities within the open-source software maintained by Google.
Despite the suspension of this program for new submissions, Google has assured that all reports submitted prior to the pause will continue to be processed. The company has yet to determine when the program may recommence but plans to offer an update in early 2027.
The reason for this abrupt pause is a significant surge in automated submissions, most of which have been deemed invalid. A post on platform X, formerly known as Twitter, from Google Bug Hunters elucidated that this influx of submissions has posed substantial challenges.
Interestingly, not all of Google’s vulnerability-reporting channels have been closed to new submissions. It continues to accept OSS VRP supply-chain reports. Furthermore, individuals who wish to report vulnerabilities in Google’s code can still do so through alternative programs, such as the Patch Rewards Program, which rewards contributions that improve the security of in-scope projects.
The surge in AI-generated bug reports has prompted organizations to reassess their vulnerability reward programs. An analysis from cybersecurity firm Malwarebytes observed that while filing credible reports has become easier thanks to AI, the labor necessary to validate these reports remains intensive. This situation has led to heightened scrutiny and potential overwhelm within security teams.
In further research published by a consortium of Australian, Chinese, and Singaporean scholars, the phenomenon of "AI slop" bug reports was explored. The researchers highlighted the cognitive burden these reports impose on human review processes, likening the challenge to a denial-of-service attack. AI-generated reports often include hallucinated vulnerabilities and misleading corrections, raising questions about their authenticity and validity.
The situation has led to discussions around possible solutions, such as using AI to effectively parse through these reports, allowing teams to focus on high-quality submissions. However, there exists a foreboding scenario where attackers intentionally generate worthless bug reports to incapacitate targeted software vendors and open-source projects.
Google’s predicament is not unique. Daniel Stenberg, the founding force behind the widely-used command-line tool, curl, has reported a similar surge in AI-originated bug submissions. Since early 2024, the validity of submissions declined drastically, with around 95% of reports received through curl’s HackerOne Bug Bounty Program being deemed invalid. Stenberg decided to halt the program to alleviate the pressure this influx placed on his security team, hoping to enhance the quality over quantity in vulnerability reports.
By April, Stenberg noted a shift in the quality of submissions, expressing relief that the program was now overwhelmed with valid reports rather than low-quality submissions. This change indicates that stricter controls and a more discerning approach can lead to better outcomes for vulnerability reporting.
The broader issue surrounding the quality of submissions is echoed within the Linux community as its maintainers find themselves grappling with an "unmanageable" influx of bug reports that complicate their workflows. In May, the Linux team issued guidelines urging individuals to submit only those vulnerabilities that pose genuine risks, stressing the importance of a responsible reporting culture within the open-source community.
The community’s challenges can be attributed to the widespread usage of similar large language models (LLMs) across the board, leading to multiple submissions of identical reports on the same vulnerabilities without sufficient context or depth. This redundancy and lack of nuance in reports make it increasingly difficult for maintainers to ascertain the legitimacy of any given submission swiftly.
Acknowledging the potential benefits of AI, Linux creator Linus Torvalds has urged users to apply these tools thoughtfully. He emphasized that for AI to be truly beneficial, it must complement human efforts rather than generate superfluous work. His advice to report findings includes thorough documentation and the submission of legitimate patches, thereby adding genuine value to the community.
In summary, Google’s pause on its open-source bug bounty program due to a spike in invalid automated submissions sheds light on a widespread issue in the tech industry. As organizations like Google and Linux grapple with the implications of AI on vulnerability reporting, it becomes clear that a balanced approach is essential in fostering a productive cybersecurity ecosystem. The challenge now lies in leveraging AI responsibly while ensuring it enhances rather than undermines security efforts.