Google freezes its open source bug bounty program after a surge in AI submissions

Google paused its open source bug bounty program after a surge in invalid automated reports. The cost falls on reviewers and researchers with valid findings.

Oct 5, 2026

Google paused its Open Source Software Vulnerability Rewards Program on October 1 after a surge in automated submissions. Most were invalid, according to the company’s statement quoted by TechCrunch. The pause gives AI-generated security reports a concrete cost: a rewards program that researchers could previously use has stopped.

The program rewarded researchers for finding vulnerabilities in Google’s open source software. TechCrunch describes the submission surge as AI-related and cites Tom’s Hardware’s reporting that invalid reports and hallucinations overwhelmed Google engineers and open source maintainers.

Google says it will provide an update in the first quarter of 2027. That leaves the restart date open. It has encouraged participants to consider its other bug bounty programs in the meantime.

Our analysis

Count valid findings against the work needed to review them

The pause exposes a mismatch between the person producing a report and the person checking it. Automating submissions can reduce the submitter’s effort while leaving engineers with claims to investigate. Google’s response shows that invalid reports can affect access to a program even for researchers whose findings are valid.

For readers assessing AI security tools, submission volume is therefore a poor measure of success on its own. The useful comparison is how many reports become confirmed vulnerabilities and how much review work those findings require. A tool that produces more reports could still make a rewards program harder to operate if most of the extra reports fail validation.

The reported statement gives a direction of change, but no submission count, exact invalid-report rate or hours spent reviewing them. Those figures would help distinguish a temporary backlog from a lasting change in the cost of running the program. When Google gives its promised update, evidence that reviewers can handle the workload would be more useful than a reopening date alone.

Google freezes its open source bug bounty program after a surge in AI submissions

Sources