[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fk6WVBzEdecC3xXhfwKnJAZzyBDOYTx0ok7D9cdK06aw":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":119},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"032b3087-f204-4186-bb80-0e746f9a0b8f","Google halts open-source bug bounty program amid AI spam surge","google-halts-open-source-bug-bounty-program-amid-ai-spam-surge-64e40d","Google has now suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after being flooded by AI-generated reports. [...]","Google has temporarily halted submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) because of a surge in AI-generated, invalid reports. The program, which rewards researchers for finding flaws in Google-maintained open-source projects, will be re-evaluated and updated, with details expected in Q1 2027. This follows similar actions by other organizations like curl and Intel, highlighting the growing challenge of AI-driven spam in bug bounty programs.","Google suspends open-source bug bounty program due to AI-generated spam.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fgoogle\u002Fgoogle-halts-open-source-bug-bounty-program-amid-ai-spam-surge\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F05\u002FGoogle.jpg","2026-10-05T08:27:46+00:00","2026-10-05T10:00:13.883343+00:00",7,[17,20,23,25,27,29],{"name":18,"type":19},"Google","vendor",{"name":21,"type":22},"Golang","product",{"name":24,"type":22},"Angular",{"name":26,"type":22},"Bazel",{"name":28,"type":22},"Protocol Buffers",{"name":30,"type":22},"Fuchsia","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21,24],{"controls":57,"vendors":113},[58,84],{"slug":59,"name":60,"problem":61,"products":62},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"attackiq","AttackIQ","\u002Fvendor-logos\u002Fattackiq.png","attackiq-ready","AttackIQ Ready","https:\u002F\u002Fwww.attackiq.com\u002Fproducts\u002Fready\u002F","Managed service that runs MITRE ATT&CK based emulations for you, with no scripting or tuning on your side.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"picus-security","Picus Security","\u002Fvendor-logos\u002Fpicus-security.png","picus-breach-and-attack-simulation","Picus Breach and Attack Simulation","https:\u002F\u002Fwww.picussecurity.com\u002Fplatform\u002Fbreach-and-attack-simulation","Continuously tests live defences against current threats, shows what controls block, detect, log and miss, and provides ready-to-apply fixes.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":80,"product_name":81,"url":82,"description":83},"attackiq-flex","AttackIQ Flex","https:\u002F\u002Fwww.attackiq.com\u002Fproducts\u002Fflex\u002F","Agentless, on-demand testing of security controls without deploying the full platform.",{"slug":85,"name":86,"problem":87,"products":88},"soc-automation","SOC automation and AI analysts","Alerts arrive faster than the team can investigate them, so real attacks wait in the queue or are closed unread.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"torq","Torq","\u002Fvendor-logos\u002Ftorq.png","torq-ai-soc-platform","Torq AI SOC Platform","https:\u002F\u002Ftorq.io\u002Fai-soc-platform\u002F","No-code security automation combined with AI agents, including the Socrates AI analyst, to triage, investigate and respond to alerts across the security stack.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"splunk","Splunk","\u002Fvendor-logos\u002Fsplunk.png","splunk-soar","Splunk SOAR","https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fproducts\u002Fsplunk-security-orchestration-and-automation.html","Security orchestration and automation that runs playbooks to investigate and respond to incidents in seconds.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"qevlar-ai","Qevlar AI","\u002Fvendor-logos\u002Fqevlar-ai.png","qevlar-ai-soc-platform","Qevlar AI SOC Platform","https:\u002F\u002Fwww.qevlar.com\u002Fproduct","Autonomous investigation of every SOC alert around the clock, using models trained for security work and set up to follow the team's own processes.",[114],{"slug":115,"name":18,"logo_path":116,"roles":117},"google","\u002Fvendor-logos\u002Fgoogle.png",[118],"affected",{"slug":120,"title":121,"body":122,"framework_refs":123,"framework_notes":130},"ai-spam-overwhelms-bug-bounty-programs-forcing-google-to-pause-oss-vrp","AI Spam Overwhelms Bug Bounty Programs, Forcing Google to Pause OSS VRP","Google's Open Source Software Vulnerability Rewards Program was forced to halt submissions due to a flood of AI-generated, low-quality vulnerability reports that overwhelmed human reviewers. This highlights a growing misuse of generative AI tools by opportunistic submitters attempting to game reward systems rather than conducting genuine security research. The consequence is serious: legitimate vulnerabilities in critical open-source projects may be delayed in discovery and remediation while triage resources are consumed by noise. This is not an isolated incident — curl and Intel have faced similar challenges — signaling a systemic industry-wide threat to the integrity of coordinated vulnerability disclosure programs.",[124,125,126,127,128,129],"NIST SP 800-40 Rev. 4 – Vulnerability Disclosure Programs","NIST CSF ID.RA-1 – Asset vulnerabilities are identified and documented","CIS Control 7 – Continuous Vulnerability Management","ISO\u002FIEC 29147 – Vulnerability Disclosure","ISO\u002FIEC 30111 – Vulnerability Handling Processes","NIST SP 800-216 – Recommendations for Federal Vulnerability Disclosure Guidelines",{}]