Google pauses open-source bug bounty after flood of AI-generated reports
Google says most new vulnerability submissions to its open-source program are invalid, often AI hallucinations, so it's freezing new reports until 2027.
What happened: Google has paused its Open Source Software Vulnerability Rewards Program (OSS VRP) as of October 1, 2026, saying it will give an update in the first quarter of 2027. The program pays researchers for finding security flaws in Google-maintained open-source projects like Golang, Angular, Bazel and Fuchsia. Google says the pause is because of a 'significant rise in automated submissions, the vast majority of which are not valid.' Reports filed before October 1, and submissions about supply-chain issues rather than product bugs, are not affected.
Why it matters: Bug bounty programs depend on humans reading and verifying each submitted report. When AI tools make it trivially easy to generate plausible-sounding but fake or hallucinated vulnerability write-ups, the flood can overwhelm the small teams of engineers and volunteer maintainers who triage them. Google isn't alone: the curl project ended its HackerOne bounty in January for the same reason, and Intel cut financial rewards from its Intigriti program in September. Microsoft has separately warned AI is increasing the overall pace of vulnerability discovery industry-wide.
How it works, plainly: Researchers normally submit a report describing a flaw, and Google's security engineers confirm it before paying out, with past rewards ranging from $100 to $31,337. Low-cost AI tools can now spit out reports that read like real findings but describe bugs that don't exist or misdiagnose code, forcing humans to manually rule out each one. Google is pausing new product-vulnerability submissions while it reworks the intake process, but researchers can still use its Patch Rewards Program or its separate Cloud VRP in the meantime.
The rollout: The freeze applies only to the OSS VRP's product-vulnerability track; supply-chain reports and earlier submissions still get processed. Google has paid out more than $81.6 million total since starting its first bounty program in 2010, including a record $17.1 million in 2025 to over 700 researchers. No detail yet on what the reworked system will look like, only that changes are expected by Q1 2027.