Google pauses its open source bug bounty over AI-generated reports

Google has paused its Open Source Software Vulnerability Rewards Program, the bounty that pays researchers for finding security flaws in Google's open source projects. The freeze took effect on October 1, 2026, and the company says it will give an update in the first quarter of 2027. The stated reason, in Google's own words, is "a significant rise in automated submissions, the vast majority of which are not valid."

In plain terms, people are pointing language models at the codebase, filing whatever the model flags as a vulnerability, and hoping for a payout. Most of these reports turn out to be hallucinations or dress up findings that are not real, and separating the few genuine bugs from the noise has worn down Google's engineers and the open source maintainers who get pulled in to review. TechCrunch reports that this is the concrete version of a fear maintainers voiced through 2025: that cheap, plausible-looking AI bug reports would swamp the volunteer review capacity these programs run on. For now, researchers are being directed to Google's other bounty programs while the open source one stays on hold. A company with Google's resources deciding the math no longer works is a sharp signal about where the cost has landed.

Why it matters

If you maintain an open source project or run any kind of vulnerability intake, the volume of AI-generated reports is now heavy enough to break a well-funded program, so budget for triage cost and filtering before you open the door to submissions.