Google Pauses OSS Bug Bounty Over AI Slop Reports
Google has stopped taking new product bug reports in its open source bug bounty after a flood of invalid AI-written submissions. Here is what is paused.
On 1 October, Google said its Open Source Software Vulnerability Reward Program (OSS VRP) would stop accepting new product vulnerability reports. The reason it gave was "an influx of invalid AI-driven reports". Supply chain reports are unaffected, anything filed before 1 October is still being processed, and Google says it will update on the programme's future by the first quarter of 2027.
What is paused and what is not
Yahoo Tech's coverage lays out the scope. The announcement itself was made in a post on X, which that article does not link, so the details below come from the reporting rather than a Google web page.
Area | Status |
|---|---|
New product vulnerability reports to the OSS VRP | Paused |
Reports filed before 1 October | Still processed |
OSS VRP supply chain reports | Unaffected |
Cloud VRP, for some Google Cloud repos | Still open |
Why Google paused it
According to the coverage, engineers were overwhelmed by thousands of poorly written reports, many of them hallucinations that were invalid or not exploitable. Time spent proving a report was wrong was time not spent fixing real flaws. The same article says similar disruption has hit Linux kernel maintenance and Intel's bug bounty, though it does not give figures, and I have not verified those.
What this tells builders
A bounty program is a market with a reviewer on one side. When producing a plausible report costs nothing, the reviewer pays the whole cost of checking it. The failure is not that AI found bugs, because it does find real ones, as this week's Rejetto HFS flaw shows. The failure is submitting AI output nobody has reproduced.
If you run an app with a public contact for security reports, expect more of this noise. If you are the one sending reports, the rule is simple: never send what you have not reproduced yourself. A model's confident description of a bug is a lead, not evidence.
For background on how these programmes work, read what an AI bug bounty program is. For the limits of AI as a bug finder, see can AI find security vulnerabilities in your code. The wider category of risks sits in the AI risks guide.
How did this land?
About the author
Senior Editor, AI & Product
Cecilia leads the Swarmz editorial desk. She has spent a decade turning complex AI and product topics into writing people actually finish, and she owns the blog's quality bar.
