Google Halts Open Source Bug Bounty Program Amid AI-Generated Report Surge

This decision reflects a growing challenge in the tech industry: balancing the influx of automated submissions with the need for quality security assessments.

• Google announced a temporary halt on new product vulnerability submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) effective October 1, 2026.
• The pause was triggered by a surge in AI-generated reports, most of which were invalid and overwhelmed human reviewers.
• Google plans to reformat the program and provide an update in Q1 2027, while still processing pre-October 1 reports.

• Prior warnings in 2025 indicated that AI-generated submissions could overwhelm bug bounty programs, leading to a decline in quality.
• Similar issues have been observed in other programs, such as curl's HackerOne bounty and Linux security reviews, where automated submissions increased but reduced the overall quality of reports.
• Google's OSS VRP previously incentivized researchers for identifying vulnerabilities in key projects like Go, Angular, and Fuchsia, making this pause a significant shift in their approach.

On October 1, 2026, Google officially paused its OSS VRP for product vulnerability submissions, citing a dramatic increase in automated, AI-generated reports that were largely invalid. This decision was not made lightly; it followed a series of warnings issued in 2025 about the potential risks posed by AI-generated submissions overwhelming bug bounty programs. The influx of these reports has created a significant burden on human reviewers, diverting resources away from legitimate security findings and ultimately compromising the integrity of the program.

The term "AI slop" has emerged in industry discussions to describe the low-quality submissions that have flooded platforms like Google’s OSS VRP. These reports often contain hallucinations—false or misleading information generated by AI tools—which complicate the review process. As a result, human reviewers at Google and open-source maintainers have found themselves inundated with noise, making it increasingly difficult to identify genuine vulnerabilities that require attention.

In response, Google has directed researchers to alternative programs, such as the Cloud VRP or Patch Rewards Program, while committing to reformatting the OSS VRP. This pause is not just a temporary fix; it signals a broader industry trend toward prioritizing human-verified submissions over automated ones. The tech community is now discussing the need for AI detection filters in bounty platforms to mitigate the impact of low-quality submissions.

The implications of this pause extend beyond Google. Other programs, like those from curl and Intel, have faced similar pressures, prompting them to tighten rules or pause their own bounty initiatives. This shift indicates a market movement toward valuing high-effort, human-verified submissions, which could reshape how security vulnerabilities are reported and rewarded across the industry.

As Google prepares to update the OSS VRP in Q1 2027, the focus will likely be on creating a more robust framework that can effectively filter out low-quality submissions while still encouraging valuable contributions from the security research community.

• Security Researchers: Those relying on bug bounties for income may see a temporary reduction in opportunities.
• Open-source Maintainers: Increased workload due to invalid submissions could lead to burnout and resource strain.
• AI Tool Users: Developers using AI tools for vulnerability reporting may need to adjust their strategies to align with new guidelines.

• Google's Q1 2027 update: This will reveal how the company plans to reformulate the OSS VRP and address the issues caused by AI submissions.
• Industry-wide responses: Look for other tech companies to implement similar measures or develop AI detection filters in their bug bounty programs.
• Trends in vulnerability reporting: Monitor how the balance between automated and human-verified submissions evolves in the coming months.