Google Halts Open Source Bug Bounty Program Over Influx of AI Submissions

Google has officially paused its Open Source Software Vulnerability Rewards Program following an overwhelming wave of automated, artificial intelligence-generated submissions. The tech giant confirmed that the freeze took effect on October 1, 2026, temporarily shutting down payouts for researchers reporting security flaws in the company's open source projects while internal teams restructure review protocols.

Company officials cited a steep rise in substandard submissions as the primary reason for halting the initiative. “This pause is due to a significant rise in automated submissions, the vast majority of which are not valid,” Google stated across social media channels and its official program platform. Engineers and open source maintainers reportedly faced severe backlogs caused by low-quality reports filled with AI hallucinations and false vulnerabilities.

The suspension marks the realization of warnings issued across the cybersecurity industry over the proliferation of so-called AI slop. Independent security experts have consistently cautioned that automated large language models incentivize bad actors and inexperienced researchers to flood vulnerability platforms with fabricated or speculative flaws in search of easy financial payouts, ultimately exhausting human triage teams.

Google indicated it will keep the program frozen through the end of the year and plans to provide an official update regarding potential changes in the first quarter of 2027. In the interim, the company advised ethical hackers and security researchers to redirect their efforts toward Google’s other operational vulnerability reward programs.