By Google has officially pressed pause on its open source bug bounty program, joining a growing list of tech giants wrestling with a very modern headache: AI-generated submission spam. The Open Source Software Vulnerability Rewards Program is offline until early 2027, and the culprit behind the shutdown is a massive wave of invalid, automated reports.
The Rise of AI Slop in Security Research
Let’s be honest, we all saw this coming. When generative text models became capable of writing coherent code snippets and vulnerability write-ups, it was only a matter of time before bad actors and opportunistic individuals tried to game the system.
Instead of manual discovery and rigorous verification, automated tools are now churning out thousands of low-quality vulnerability reports. Security teams are drowning in hallucinations, phantom bugs, and completely invalid submissions that look convincing at a glance but crumble under actual scrutiny.
Why Google Had to Pull the Plug
Bug bounty programs rely on a delicate ecosystem of trust, expertise, and manual triage. When open source maintainers and Google engineers spend more time filtering out AI-generated junk than fixing actual zero-days, the entire model breaks down.
- Overwhelmed Reviewers: Maintainers simply do not have the bandwidth to sift through hundreds of fabricated claims every week.
- Signal-to-Noise Ratio: Real security researchers find their valid submissions buried under an avalanche of automated noise.
- Resource Drain: Valuable engineering hours are wasted validating machine-hallucinated threats instead of securing critical infrastructure.
What This Means for the Future of Bug Bounties
Google’s decision highlights a deeper systemic crisis within cybersecurity. As AI tools lower the barrier to entry for generating technical text, platforms will need to implement much stricter verification layers.
Until Google brings the program back online with better automated defenses, researchers looking to cash in on vulnerabilities will have to focus on the company’s other, more tightly controlled bug bounty initiatives. One thing is certain: the era of easy, low-effort submissions is officially over.
Comments