AI Spam Overwhelms Bug Bounty Programs, Forcing Google to Pause OSS VRP
Written by AI from the linked story. Not reviewed by an editor. How this works
Google's Open Source Software Vulnerability Rewards Program was forced to halt submissions due to a flood of AI-generated, low-quality vulnerability reports that overwhelmed human reviewers. This highlights a growing misuse of generative AI tools by opportunistic submitters attempting to game reward systems rather than conducting genuine security research. The consequence is serious: legitimate vulnerabilities in critical open-source projects may be delayed in discovery and remediation while triage resources are consumed by noise. This is not an isolated incident — curl and Intel have faced similar challenges — signaling a systemic industry-wide threat to the integrity of coordinated vulnerability disclosure programs.
Tactical Insight
Immediate actions
- Implement automated pre-screening filters (e.g., duplicate detection, AI-content classifiers) to reject low-quality submissions before human triage.
- Require submitters to provide proof-of-concept code or detailed reproduction steps as a mandatory field to raise the effort bar.
Program integrity improvements
- Introduce tiered submission vetting, such as reputation scores or prior approval requirements, to prioritize trusted researchers.
- Establish clear submission quality guidelines and publish examples of invalid vs. valid reports to deter low-effort AI-generated entries.
- Consider rate-limiting submissions per account and enforcing cooling-off periods after repeated invalid reports.
Detection & monitoring measures
- Deploy logging and analytics on submission patterns to detect coordinated spam surges early.
- Track and publish abuse metrics periodically to maintain transparency and deter bad-faith participation.