Google suspends open-source bug bounty program due to AI-generated report surge
Google has suspended submissions to its Open Source Software Vulnerability Reward Program (OSS VRP) effective October 1, 2026, citing a significant rise in invalid AI-generated bug reports. The company stated it will provide an update by Q1 2027 while reforming the program, and confirmed that prior submissions remain unaffected. Researchers are encouraged to use other Google VRP programs or the…
Key points
- Google suspended OSS VRP product vulnerability submissions effective October 1, 2026.
- The suspension is due to a significant rise in invalid AI-generated bug reports.
- Google will provide an update on the program by Q1 2027.
The suspension does not impact OSS VRP supply chain reports or outstanding reports. Google noted that the influx of AI-generated reports has overwhelmed engineers and maintainers, who spend excessive time validating low-quality submissions instead of addressing real vulnerabilities. Similar actions have been taken by Linux maintainers and Intel, though Intel has not officially confirmed AI as the cause.
All three sources agree on the core facts: the suspension date, reason, duration, and alternative reporting paths. No conflicting figures or timelines were reported across the articles.
Google freezes open-source bug bounty program amid flood of invalid AI slop submissions
Tom's Hardware · 3 October 2026
Loading the full article…
This text was published by Tom's Hardware and written by Etiido Uko. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
Coverage and discussion
5sources- Hacker News discussion · 11 pointsnews.ycombinator.com
- AI is breaking one of the most important ways we keep technology safePress · yahoo.com ·
- Google Suspends Open-Source Bug Bounty Due to AI Vulnerability ReportsPress · infosecurity-magazine.com ·
- Google halts open-source bug bounty program amid AI spam surgePress · bleepingcomputer.com ·
- Google froze its open source bug bounty program due to a ‘significant rise’ in AI submissionsPress · TechCrunch AI ·
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Policy & Regulation
All →- Opinion: open-weight AI models may worsen cyber risks without banning closed APIs · 1 src
- OpenAI and Anthropic support mandatory AI breach reporting in Australia · 8 src
- OpenAI to apologise to Australia over Medicare hack · 5 src
- Microsoft AI chief Mustafa Suleyman calls Anthropic's Claude training dangerous · 1 src
- US court hears case over AI-generated meme’s ownership rights · 1 src
Comments
via GitHub Discussions