Google Suspends Open Source Bug Bounty Program Due to AI Submissions Influx

Summary

Google suspended its Open Source Software Vulnerability Rewards Program as of October 1, 2026. The company cited a "significant rise" in invalid AI-generated submissions that overwhelmed its engineers and maintainers. Google plans to provide an update on the program's status in the first quarter of 2027. Participants are encouraged to use other Google bug bounty programs in the interim.

Key points

Google paused its open source bug bounty program on October 1, 2026.
The suspension is due to a "significant rise" in invalid AI-generated submissions.
Google engineers were reportedly overwhelmed by invalid or "hallucinated" reports.
An update on the program's status is expected in the first quarter of 2027.
Cybersecurity experts had previously warned about "AI slop" risks to bug bounty programs.
Participants can still submit to other Google bug bounty programs.

Google has temporarily suspended its open source bug bounty program, citing a "significant rise" in submissions generated by artificial intelligence. The program, known as Google’s Open Source Software Vulnerability Rewards Program, was paused as of October 1, according to the company.

The tech giant stated that the halt is "due to a significant rise in automated submissions, the vast majority of which are not valid." Google has indicated it plans to provide an update on the program's status in the first quarter of 2027.

The Open Source Software Vulnerability Rewards Program was established to compensate researchers for identifying vulnerabilities within Google's open source software. However, the influx of AI-generated reports has reportedly overwhelmed the system.

Context and Background

The challenges faced by Google's program align with prior warnings from cybersecurity experts. Last year, TechCrunch reported that these experts had cautioned that "AI slop" posed a serious risk to the efficacy of bug bounty programs.

According to a report by Tom’s Hardware, Google engineers and open source maintainers were reportedly overwhelmed by the volume of submissions. These reports were described as either invalid or containing "hallucinations," a term often used to describe fabricated or incorrect information generated by AI systems.

Google communicated the pause through posts on X and its program website.

Future Steps

While the open source bug bounty program remains suspended, Google has encouraged participants to consider submitting findings to its other existing bug bounty programs. The company has committed to offering further information regarding the paused program early next year.

Frequently Asked Questions

When was the program suspended and when will it resume?

The Open Source Software Vulnerability Rewards Program was paused as of October 1, 2026. Google has committed to providing an update on the program's status in the first quarter of 2027.

What was the impact of AI submissions on the program?

The influx of AI-generated reports reportedly overwhelmed Google engineers and open source maintainers. Many of these reports were described as invalid or containing "hallucinations."

Can researchers still submit vulnerabilities to Google?

Yes, while the open source program is suspended, Google has encouraged participants to consider submitting findings to its other existing bug bounty programs.

This report was compiled with AI assistance from the sources listed above and reviewed by a human editor before publication. Corrections: /contact