Google halts open-source bug bounty program amid AI spam surge
Google suspends open-source bug bounty program due to AI-generated spam.
Google has temporarily halted submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) because of a surge in AI-generated, invalid reports. The program, which rewards researchers for finding flaws in Google-maintained open-source projects, will be re-evaluated and updated, with details expected in Q1 2027. This follows similar actions by other organizations like curl and Intel, highlighting the growing challenge of AI-driven spam in bug bounty programs.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonGoogle's Open Source Software Vulnerability Rewards Program was forced to halt submissions due to a flood of AI-generated, low-quality vulnerability reports that overwhelmed human reviewers. This highlights a growing misuse of generative AI tools by opportunistic submitters attempting to game reward systems rather than conducting genuine security research. The consequence is serious: legitimate vulnerabilities in critical open-source projects may be delayed in discovery and remediation while triage resources are consumed by noise. This is not an isolated incident — curl and Intel have faced similar challenges — signaling a systemic industry-wide threat to the integrity of coordinated vulnerability disclosure programs.
What helps against this
How we list vendors
- Breach and attack simulation
You only find out whether your security tools stop an attack when a real attacker tries.
- SOC automation and AI analysts
Alerts arrive faster than the team can investigate them, so real attacks wait in the queue or are closed unread.