Google Suspends Its Open-Source Bug Bounty Program Amid a Surge in AI-Generated Submissions

Headline: Google Pauses Open Source Bug Bounty Program Over Automated AI Submissions

Meta Description: Google pauses Open Source Bug Bounty Program until next year after a significant rise in automated, mostly invalid AI submissions; update expected in Q1 2027.

Tags: Google, bug bounty, open source, AI submissions, security triage

Featured image: abstract shield-like network of data streams, no people, no logos, no text.

Google open source bug bounty program is being paused until next year after the company pointed to a significant rise in AI-generated and automated submissions. The suspension applies to Google's Open Source Software Vulnerability Rewards Program and shows how generative AI can strain the review layer that makes vulnerability reporting useful. A report queue can remain full while providing few actionable findings, especially when submissions are generated by systems that produce plausible but false details.

Background: Why Human Review Matters for Open Source Bugs
Vulnerability reward programs ask researchers to submit security issues for review, with valid findings typically receiving recognition or compensation. For open source projects, that process is not only a security function; it is also a maintenance function. Repository owners and maintainers must read reports, reproduce behavior, assess severity, and decide whether a bug needs a patch, a configuration change, or a response to the submitter. The workload is manageable when reports are limited and tied to real research. It becomes harder when automated tools can create many near-identical or speculative entries.

Development: AI Reports Change the Triage Balance
TechCrunch reported last year that cybersecurity experts warned about AI slop as a risk to bug bounty programs. Tom's Hardware reported that Google engineers and open source maintainers were overwhelmed by invalid or hallucinated reports. In this context, hallucinated reports are submissions that may sound coherent but contain invented technical details, nonexistent code behavior, or unsupported exploit narratives. The problem is not simply volume. The problem is signal dilution: each low-quality submission still requires initial attention, and a small number of maintainers can be forced to spend time separating useful findings from noise.

Google's suspension makes the operational cost visible. When the cost of producing a report falls because AI can generate text or technical-sounding claims, the cost of filtering those reports rises for humans. That dynamic can affect not only Google's program but also other bug bounty platforms that rely on researcher submissions and maintainer review.

Latest Progress: October 1 Pause and Q1 2027 Update
Google said the Open Source Software Vulnerability Rewards Program was paused as of October 1, and the company said it would provide an update in the first quarter of 2027. The company described the pause as lasting until next year. In its statement, Google said, "This pause is due to a significant rise in automated submissions, the vast majority of which are invalid." It also encouraged researchers to consider Google's other bug bounty programs while the open source rewards track is suspended.

The timeline is important: the program did not appear to close permanently. Instead, it entered a temporary suspension while Google evaluates intake quality and triage capacity. That suggests the immediate issue is not the absence of security researchers, but the mismatch between submission volume and the human review needed to turn reports into fixes.

What to Watch Next: Q1 2027 Update
The next milestone is the first quarter of 2027, when Google is expected to update the status of the program. The update may show whether the suspension is a short-term triage reset or the start of a broader change in how open source vulnerability reports are accepted. For now, Google open source bug bounty program remains suspended until next year, while the broader AI-generated reporting problem stays in view.