GoKawiilGoogle halts open-source bug bounty program amid AI-generated report overload
Google has temporarily suspended its Open Source Software Vulnerability Rewards Program (OSS VRP) due to an overwhelming influx of automated, AI-generated vulnerability reports. The company cited a majority of these submissions as invalid or hallucinated, straining reviewer resources. The pause, effective October 1, affects new submissions, with plans to update the program's structure by early 2027.
GoKawiil's interpretation of the reporting above, not reported fact.
This development highlights the challenges organizations face as generative AI tools produce large volumes of code contributions and security reports. It suggests that even well-resourced programs like Google's may need to adapt their vetting processes to manage AI-driven noise, which could influence how bug bounty initiatives evolve in the future.
- AI-generated security reports can overwhelm review teams.
- Google's bug bounty program is temporarily paused to address this issue.
- The company plans to reform the program and update stakeholders in early 2027.
Source: techspot.com — Alfonso Maruccia, 2026-10-05
Published there as: “Google pauses bug bounties for open source because AI slop reports are drowning its reviewers”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.