Google froze its open source bug bounty program due to a 'significant rise' in AI submissions | TechCrunch

1 minute from techcrunch.com. Saved Oct 6, first published October 2026.

Open the original

Short summary

Google froze its open source bug bounty program starting October 1 because AI-generated submissions overwhelmed the system with invalid reports and hallucinations. The company won't reopen it until Q1 2027.

  • Google engineers and open source maintainers were flooded with automated submissions that were mostly invalid or contained AI hallucinations, making the program unmanageable.
  • The pause confirms cybersecurity experts' earlier warnings that AI-generated content poses a real threat to bug bounty programs by degrading their signal-to-noise ratio.
  • Google is redirecting participants to its other bug bounty programs while it figures out how to handle the AI submission problem.

Full summary

Google shut down its Open Source Software Vulnerability Rewards Program on October 1st because AI-generated submissions flooded the system. The company said the vast majority of these automated reports were either invalid or contained hallucinations — basically nonsense. Google promised to restart the program in Q1 2027, though they haven't spelled out what changes they'll make to fix the problem. This wasn't exactly a surprise. TechCrunch reported last year that security experts were already flagging AI as a threat to bug bounty programs. The warnings turned out to be accurate. Google's engineers and open source maintainers got buried under junk submissions, making it impossible to sort through legitimate vulnerability reports. The sheer volume of garbage overwhelmed their ability to actually do the work. For now, security researchers who want to report bugs to Google have other options. The company runs multiple bug bounty programs beyond just the open source one, so people can redirect their efforts there. But the shutdown highlights a real problem: as AI tools get easier to use, they're being weaponized to spam security programs with automated noise, which defeats the entire purpose of having human experts review vulnerabilities.

Ask about this article

No questions yet.