AI-Generated False Reports Force Google to Halt Open Source Bug Bounty Initiative
Google suspended its open source bug bounty program effective October 1st after experiencing a surge in automated, invalid submissions containing hallucinations. Engineers and maintainers became overwhelmed processing reports that lacked legitimate security vulnerabilities. The pause will remain in effect until at least the first quarter of 2027, when the company plans to provide an update on resumption plans.
Google's decision to suspend its Open Source Software Vulnerability Rewards Program reflects growing challenges in managing crowdsourced security research. The initiative, which incentivized independent researchers to identify flaws in the company's open source projects, fell victim to an influx of machine-generated submissions lacking legitimate security concerns. This disruption forced Google's engineering teams and open source maintainers to expend significant resources sorting through invalid reports before genuine vulnerabilities could receive proper attention.
The suspension underscores warnings that cybersecurity experts had previously raised about artificial intelligence's capacity to generate misleading technical content. Rather than strengthen security defenses, automated submissions flooded the program with false positives, ultimately counterproductive to its stated mission of improving software integrity across the open source ecosystem.
This pause could reshape how organizations approach community-driven security initiatives. Researchers relying on bug bounty income may face reduced opportunities, while companies managing open source projects might experience temporary gaps in vulnerability detection. The situation may incentivize development of better filtering mechanisms or submission verification protocols, potentially establishing new standards for legitimate participation. However, the extended pause until 2027 raises questions about whether crowdsourced security models remain viable without stronger safeguards against automated abuse.