Google froze its open source bug bounty program due to a ‘significant rise’ in AI submissions

YOU KNOW WHAT IS ACTUALLY MENTAL HAVE YOU HEARD ABOUT GOOGLE TODAY NO OF COURSE YOU HAVE NOT SO LISTEN BECAUSE GOOGLE JUST COMPLETELY FROZE ITS ENTIRE OPEN SOURCE BUG BOUNTY PROGRAM AS OF OCTOBER FIRST AND THE REASON IS BASICALLY PURE CHAOS BECAUSE THEY ARE GETTING HIT WITH A SIGNIFICANT RISE IN AUTOMATED AI SUBMISSIONS AND THE THING IS THE VAST MAJORITY OF THESE REPORTS ARE TOTALLY INVALID OR STRAIGHT UP FULL OF HALLUCINATIONS SO THE ENGINEERS AND OPEN SOURCE MAINTAINERS WERE JUST GETTING ABSOLUTELY DROWNED IN JUNK INSTEAD OF REAL SECURITY FLAWS AND NOW GOOGLE HAS SHUT DOWN THE WHOLE REWARDS PROGRAM UNTIL AT LEAST NEXT YEAR WITH A PROMISE TO GIVE EVERYONE AN UPDATE IN THE FIRST QUARTER OF 2027 WHICH IS WILD BECAUSE PEOPLE USED TO GET PAID REAL MONEY FOR FINDING ACTUAL VULNERABILITIES. ANYWAY WHERE DID EVERYONE GO?

THIS IS THE KIND OF THING THAT KEEPS ME UP FIRST LAST YEAR CYBERSECURITY EXPERTS WARNED EVERYONE THAT AI SLOP WAS A MASSIVE RISK TO BUG BOUNTIES AND THEN ON OCTOBER FIRST GOOGLE WENT AND FROZE THEIR ENTIRE OPEN SOURCE SOFTWARE VULNERABILITY REWARDS PROGRAM UNTIL NEXT YEAR WHICH IS WILD BECAUSE RESEARCHERS USED TO GET PROPER REWARDS FOR FINDING REAL DEFECTS IN OPEN SOURCE TECH AND NOW GOOGLE SAYS THERE WAS A SIGNIFICANT RISE IN AUTOMATED SUBMISSIONS AND THE THING IS THE VAST MAJORITY OF THEM WERE NOT EVEN VALID SO GOOGLE ENGINEERS AND MAINTAINERS WERE APPARENTLY GETTING COMPLETELY DROWNED IN PURE HALLUCINATIONS AND NOW WE HAVE TO WAIT UNTIL THE FIRST QUARTER OF 2027 JUST TO GET AN UPDATE FROM THEM ON WHAT HAPPENS NEXT. ANYWAY THAT IS WHY I AM LIKE THIS.

Google has paused its open source bug bounty program until early 2027 after engineers were overwhelmed by a flood of invalid, AI-generated vulnerability reports.

Named in this and it is not fair or not accurate? Write to us — we correct or remove within a few days.