Google pauses open source bug bounty over AI submissions

Google has paused its Open Source Software Vulnerability Rewards Program, effective October 1, 2026, due to a surge in automated submissions. According to TechCrunch, the company stated that the "vast majority" of recent reports were invalid, forcing a temporary halt to the initiative until at least the first quarter of 2027.

The decision marks a significant shift in how major tech companies handle security research, as the influx of AI-generated content has created a bottleneck for human engineers. Google confirmed the pause via posts on X and its official program website, noting that the program would remain suspended until an update is provided in early 2027. This move follows warnings from cybersecurity experts last year that "AI slop" posed a serious risk to the integrity of bug bounty programs.

The impact of automated noise

The core issue is not the number of submissions, but their quality. According to Tom’s Hardware, Google engineers and open source maintainers were overwhelmed by reports that were either invalid or contained hallucinations. In a standard bug bounty workflow, triage is a manual, high-cognitive-load process. When a significant portion of that queue consists of AI-generated false positives, the cost of triage per valid vulnerability skyrockets.

Google’s statement was direct: "This pause is due to a significant rise in automated submissions, the vast majority of which are not valid." This suggests that the signal-to-noise ratio has degraded to a point where the program is no longer sustainable under its current operational model. The company has encouraged participants to consider other Google bug bounty programs in the interim, indicating that the issue is specific to the open source component, which likely lacks the same level of automated filtering or dedicated triage teams as its proprietary offerings.

Context: The rise of AI in security research

This development is part of a broader trend where large language models are being applied to code analysis and vulnerability discovery. While AI tools can certainly identify known vulnerability patterns quickly, they often lack the contextual understanding required to determine if a finding is actually exploitable in a specific codebase. This has led to a phenomenon often described as "AI slop" in the security community, where low-effort, high-volume submissions clog reporting channels.

Last year, TechCrunch reported that cybersecurity experts were warning of this exact risk. The concern was that bad actors or even well-meaning but misguided researchers would use AI to generate thousands of low-quality reports, overwhelming security teams. Google’s decision to pause the program validates those warnings, demonstrating that the operational cost of filtering out AI-generated noise has become a critical bottleneck.

What it means for developers

For developers and security researchers, this pause has immediate practical implications. First, any active submissions to the Google Open Source Software Vulnerability Rewards Program should be considered closed for now. Researchers should check the program’s status before submitting new findings to avoid wasted effort. Second, this incident highlights the importance of quality over quantity in security research. As AI tools become more accessible, the ability to produce high-confidence, well-documented vulnerability reports will become a key differentiator.

Developers should also be aware that this trend may spread to other companies. If Google, with its vast resources, is pausing a major program due to AI-generated noise, smaller organizations may be even more vulnerable to such overload. This could lead to a more defensive posture from security teams, potentially including stricter submission requirements or automated filtering that may inadvertently reject valid findings.

What to watch

• Q1 2027 Update: Google has promised an update in the first quarter of 2027. Watch for announcements about how the program will resume, including any new guidelines for submission quality or changes to the triage process.
• Industry Response: Monitor whether other major tech companies, such as Microsoft, Apple, or Amazon, implement similar pauses or changes to their bug bounty programs in response to AI-generated submissions.
• AI Tooling Evolution: Keep an eye on the development of AI security tools. If these tools become more accurate and better at filtering out false positives, the issue of "AI slop" may diminish, potentially allowing programs to resume with greater confidence.
• Policy Changes: Look for any new policies or guidelines from security organizations, such as the Open Web Application Security Project (OWASP), regarding the use of AI in vulnerability reporting and the responsibilities of researchers to ensure the quality of their submissions.