Google Halts Open Source Bug Bounty Program as AI-Generated Submissions Flood In

Google has frozen its open source bug bounty program following a 'significant rise' in AI-generated submissions, according to a TechCrunch report. The program, which rewards researchers for finding vulnerabilities in open source software, was paused after the volume of automated and low-quality reports overwhelmed the review process. The exact date of the freeze was not immediately disclosed.

The decision comes amid growing concerns that AI slop—low-quality, machine-generated content—is flooding bug bounty platforms. While Google did not provide specific numbers, the company described the increase as 'significant.' Bug bounty programs rely on human triage to verify legitimate vulnerabilities, and AI-generated reports often lack the depth or accuracy required, wasting maintainers' time and resources. This is not the first time AI has disrupted such programs; other platforms have reported similar issues.

The freeze underscores a broader challenge for the cybersecurity community: how to adapt vulnerability disclosure to an era of AI-generated noise. If left unaddressed, AI slop could erode trust in bug bounty programs and slow down critical security fixes. Google's move may prompt other organizations to reassess their own programs, potentially leading to stricter submission criteria or AI-detection tools. The company has not indicated when the program might resume.