Google pauses its open source bug bounty because of a flood of AI-written reports

Google has paused its Open Source Software Vulnerability Rewards Program since 1 October, saying there was a significant rise in automated submissions, the vast majority of which are not valid. Engineers and open source maintainers were reportedly overwhelmed by reports that were invalid or contained made-up details. Google promises an update in the first quarter of 2027 and points researchers to its other bug bounty programs in the meantime.

• If you publish or depend on open source software, check how your supplier handles security reports, because slower fixes are possible while review teams sift through AI-written noise.
• If you take reports from outside people, such as through a security contact address, decide now who reads them and how you tell a real warning from automated spam.

Source: TechCrunch. This is our short summary of their reporting. The paragraphs marked "Our read" and the things to do are SeedFoundry's opinion. The summary is drafted with AI tools. The picture is our own graphic. How we source and credit