Google has paused its Open Source Software Vulnerability Rewards Program, the bug bounty that pays researchers for finding flaws in Google's open-source projects, TechCrunch reported Sunday. The company blamed a sharp rise in automated submissions, most of which it said were not valid.

What Happened

Google announced the pause on X and on its Bug Hunters program website, saying it took effect Oct. 1. The company said it will provide an update in the first quarter of 2027.

In its statement, Google attributed the decision to "a significant rise in automated submissions," adding that the vast majority were invalid. TechCrunch, citing Tom's Hardware, reported that Google engineers and open-source maintainers had been overwhelmed by reports that were wrong or contained hallucinations, meaning details that an AI system had invented.

RelatedNew curl Release Fixes 24 Flaws, Including a High-Severity Bug Reported With Anthropic’s Claude

Google is directing researchers to its other bug bounty programs while the open-source program is on hold. It has not said how many reports it received or what share were generated by AI tools.

Why It Matters

Bug bounties depend on a workable ratio of useful reports to noise. Each submission has to be read and checked by someone with enough expertise to tell whether a claimed vulnerability is real. Generative AI has made it almost free to produce reports that look plausible, complete with code snippets and technical language, which shifts the cost onto the people doing triage.

For open-source projects, that burden often falls on a small number of maintainers, many of them volunteers or engineers with other responsibilities. When their time goes to disproving fabricated findings, real bugs can wait longer for fixes. Maintainers of several widely used projects have complained publicly over the past year or more about low-quality AI submissions.

Google's decision carries weight because it is one of the largest corporate funders of open-source security work. Its program covered projects the company maintains and has offered cash rewards for findings in them. Pausing it removes a paid incentive for outside researchers to look at that code, at least temporarily.

Context

TechCrunch reported last year that security experts were warning that AI-generated "slop" posed a threat to bug bounty programs, and the problem has grown as AI coding and analysis tools have become more capable and more widely available.

The same tools are also producing genuine findings. Security teams, including Google's own, have used AI systems to discover real vulnerabilities, which complicates any blanket response. The challenge for program operators is to keep accepting legitimate AI-assisted research while screening out mass-produced reports that have not been verified by a human.

What to Watch

Google has promised an update in the first quarter of 2027 but has not said what changes it is considering. Possible approaches used elsewhere include requiring proof-of-concept code, limiting submissions from new accounts and penalizing researchers whose reports are repeatedly invalid.

Other bug bounty operators and open-source foundations will be watching. If Google, with its resources, cannot manage the volume under the current model, smaller programs facing the same flood may follow with pauses or tighter rules of their own.