Google has paused new product-vulnerability submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP), blaming a "significant rise" in automated, AI-generated reports — the vast majority of which turn out to be invalid.
A flood of AI slop
The pause took effect on October 1, Google said in posts on X and on the program's website, with an update on the program's future promised in the first quarter of 2027. The company said the halt was a response to "a significant rise in automated submissions, the vast majority of which are not valid."
Google's engineers and open-source maintainers had been overwhelmed by reports that were invalid or contained hallucinations, according to Tom's Hardware. Researchers using AI tools were generating reports that claimed to find security flaws but turned out to be coding errors with no security impact — or fabricated vulnerability details that forced engineers to spend their time manually validating code instead of fixing real bugs.
The development is one that cybersecurity experts had warned about: TechCrunch reported last year that researchers feared AI-generated noise posed a serious risk to bug bounty programs. OSS VRP, which Google launched in 2022, pays independent security researchers who find and privately report flaws in the company's open-source software, including projects such as Go, Angular and Protocol Buffers.
A narrow pause, not a shutdown
The freeze is narrower than the headlines suggest. Reports filed before October 1 are still being processed, and supply-chain submissions — covering compromised build pipelines and tampered packages — are unaffected. Researchers can also still route some vulnerabilities affecting Google Cloud products through the separate Cloud VRP. Participants were encouraged to explore Google's other bug bounty programs in the meantime.
The episode highlights a growing paradox for the security industry: AI is making it easier to find bugs, but the cost of sifting through a rising volume of unactionable, machine-generated reports is starting to crack the systems meant to receive them.
Sources:
TechCrunch: Google froze its open source bug bounty program due to a 'significant rise' in AI submissions
Help Net Security: AI slop submissions force Google to freeze its open-source bug bounty
A flood of AI slop
The pause took effect on October 1, Google said in posts on X and on the program's website, with an update on the program's future promised in the first quarter of 2027. The company said the halt was a response to "a significant rise in automated submissions, the vast majority of which are not valid."
Google's engineers and open-source maintainers had been overwhelmed by reports that were invalid or contained hallucinations, according to Tom's Hardware. Researchers using AI tools were generating reports that claimed to find security flaws but turned out to be coding errors with no security impact — or fabricated vulnerability details that forced engineers to spend their time manually validating code instead of fixing real bugs.
The development is one that cybersecurity experts had warned about: TechCrunch reported last year that researchers feared AI-generated noise posed a serious risk to bug bounty programs. OSS VRP, which Google launched in 2022, pays independent security researchers who find and privately report flaws in the company's open-source software, including projects such as Go, Angular and Protocol Buffers.
A narrow pause, not a shutdown
The freeze is narrower than the headlines suggest. Reports filed before October 1 are still being processed, and supply-chain submissions — covering compromised build pipelines and tampered packages — are unaffected. Researchers can also still route some vulnerabilities affecting Google Cloud products through the separate Cloud VRP. Participants were encouraged to explore Google's other bug bounty programs in the meantime.
The episode highlights a growing paradox for the security industry: AI is making it easier to find bugs, but the cost of sifting through a rising volume of unactionable, machine-generated reports is starting to crack the systems meant to receive them.
Sources:
TechCrunch: Google froze its open source bug bounty program due to a 'significant rise' in AI submissions
Help Net Security: AI slop submissions force Google to freeze its open-source bug bounty
