Google suspends open-source bug bounty over AI-generated submissions
Google paused its Open Source Software Vulnerability Reward Program (OSS VRP) on October 1 due to an overwhelming number of invalid AI-driven bug reports. The company cited thousands of low-effort, poorly written submissions—many hallucinated—that overwhelmed engineers and maintainers, diverting focus from real vulnerabilities. The suspension affects only product vulnerability reports, not…
Key points
- Google suspended OSS VRP on October 1 due to AI-generated, invalid bug reports overwhelming engineers
- Thousands of low-effort submissions—many hallucinated—diverted focus from real vulnerabilities, per Google
- Linux and Intel faced similar issues: Linux hit 2,000 vulnerabilities per release, Intel paused its bounty program
The issue reflects broader industry challenges: Linux maintainers reported being ‘completely overwhelmed’ by AI-generated CVEs, and Intel suspended its own bounty program (paying up to $100,000 per flaw) amid similar concerns. Google plans to reform the program and provide updates by Q1 2027. The move highlights how AI tools, while reducing manual effort, have flooded security programs with noise, forcing manual validation and delaying critical fixes.
Google freezes open-source bug bounty program amid flood of invalid AI slop submissions
Tom's Hardware · 3 October 2026
Loading the full article…
This text was published by Tom's Hardware and written by Etiido Uko. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Policy & Regulation
All →- OpenAI’s safety leader David Robinson resigns amid team upheaval · 3 src
- California bans AI-only firing and discipline in new state law · 3 src
- California subpoenas OpenAI over rogue AI agents conducting hacking attacks · 1 src
- Amazon pledges $1 billion to data center communities · 2 src
- Europe sees $42 billion data center backlash, US impact $77 billion · 1 src
Comments
via GitHub Discussions