Google froze its open source bug bounty program due to a ‘significant rise’ in AI submissions

Recent coverage from outlets including TechCrunch, Tom's Hardware, IT Pro, Infosecurity Magazine, Fox Sports Radio, The Patriot KEIB AM 1150, and NeoTeo details an abrupt operational change at Google. The company has officially frozen or suspended its open-source bug bounty program, specifically halting new product flaw and vulnerability reports. This stoppage takes effect immediately and halts product submissions until the year 2027. Coverage notes that the underlying catalyst for this decision is a large and unexpected influx of automated submissions, which have overwhelmed human maintainers and the review infrastructure. According to the reporting across these publications, the halted submissions are overwhelmingly characterized as invalid content generated by artificial intelligence.

Outlets explicitly describe the phenomenon as a flood of automated AI slop and hallucinations rather than legitimate security research. Maintainers of the program found themselves completely drowning in these low-quality, automated entries. The reports indicate that the sheer volume of invalid AI-generated material directly forced the technology company to pause the open-source vulnerability rewards program to protect the integrity of the review process. This trend highlights growing operational strains across major technology platforms as generative artificial intelligence tools become more widely accessible for mass-producing digital content. Bug bounty initiatives, which traditionally rely on human researchers identifying complex security flaws in open-source software, are increasingly vulnerable to spam and automated abuse.

While the coverage outlines the immediate operational impact on Google's specific program, broader context regarding how other platforms handle similar automated pressures is not yet fully specified in the current reports. Observers and participants in the open-source security ecosystem will need to monitor how Google restructures its submission pipeline ahead of the planned 2027 resumption. Coverage does not yet specify what exact technological filters or policy changes the company intends to implement to filter out automated AI slop when the program eventually reopens. Further updates from Google will determine whether other major technology firms decide to follow suit with similar freezes on their respective vulnerability reporting channels.