Google Pauses Bug Bounty After AI Flood of Fake Reports

Google has temporarily shut down its bug bounty program for open source software after being overwhelmed by a flood of AI-generated submissions. The program, which rewards researchers for finding security vulnerabilities in Google's open source code, was paused on October 1. Google says the pause is due to a "significant rise in automated submissions, the vast majority of which are not valid." In other words, too many people are using AI to churn out fake or low-quality bug reports, and it's drowning out the real ones.

Bug bounty programs are a way for companies to crowdsource security testing. Ethical hackers find flaws and report them in exchange for cash rewards. But with the rise of AI tools that can generate plausible-sounding but incorrect reports, these programs are getting spammed. Google engineers and open source maintainers are spending time triaging junk instead of fixing actual security holes. This is bad for everyone: real vulnerabilities stay unfixed longer, and the people who rely on that software—which includes you, since open source powers much of the internet—are left more exposed.

Google hasn't said exactly when the program will return, only that it will provide an update in the first quarter of 2027. In the meantime, they're encouraging researchers to participate in other bug bounty programs. The company's decision highlights a growing problem: as AI makes it easier to generate content, it also makes it easier to generate noise. For bug bounties, that noise can have serious consequences for cybersecurity.

For the average person, this means the software you use every day might have undiscovered security holes that aren't being reported and fixed as quickly. It also shows how AI is changing the landscape of online security—both for better and for worse. While AI can help find bugs, it can also create a lot of distractions. Google's pause is a wake-up call for the tech industry to find better ways to manage AI-generated submissions.