TechCrunch / Tom's Hardware / Google VRP
Important
GoogleSecurityOpen SourceAI SlopGoogle pauses open-source bug bounty after flood of invalid AI-generated reports
October 4, 20262 min read
Google suspended product vulnerability submissions to its Open Source Software Vulnerability Rewards Program as of October 1, citing a significant rise in automated submissions that were mostly invalid. An update is promised for Q1 2027; supply-chain reports and other VRPs remain open.
Why it matters
AI tools are breaking a core security feedback loop. When bounty programs and maintainers cannot triage signal from hallucinated noise, real vulnerabilities take longer to surface — the opposite of what AI-assisted security was supposed to deliver.
Google has paused product vulnerability submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP), effective October 1, after a surge of automated reports that were overwhelmingly invalid.
Google’s Bug Hunters account and program page said the pause is due to a significant rise in automated submissions, the vast majority of which are not valid. Coverage attributes the flood to AI-generated reports — including hallucinated findings and low-impact noise — that overwhelmed engineers and open-source maintainers. Reports filed before October 1 continue to be processed. Supply-chain reports under the same program are unaffected, and researchers are directed to other Google VRP tracks and the Patch Rewards Program. Google said it will rework this part of the OSS VRP and provide an update in the first quarter of 2027.
The move follows similar pressure on Linux maintainers and at least one other vendor that has restricted or paused bounty intake as automated AI hunters scaled submission volume faster than human triage.