Google Pauses Open Source Bug Bounty After Surge of AI-Generated Reports

Google has frozen its open source bug bounty program, the company confirmed, after a sharp increase in submissions that appear to be generated by artificial intelligence rather than produced by human security research. The program, which pays researchers for finding and reporting flaws in widely used open source software, is on hold while the company works out how to handle the flood.

The problem is not that the reports are malicious. It is that they are numerous, plausible-looking, and frequently wrong. A language model can churn out a description of a suspected vulnerability in minutes, complete with code snippets and a confident writeup, and each one still has to be read by a human triager before it can be dismissed. At scale, that turns a rewarding volunteer pipeline into a queue of near-duplicate noise.

Bug bounty operators have been warning about this for more than a year. Programs at major vendors have reported rising volumes of reports that fail basic reproducibility checks, and some maintainers have started requiring proof-of-concept exploits before a submission is even triaged. Google's decision to pause rather than tighten filters suggests the cost of reviewing AI-assisted reports has crossed the point where the program can still function as designed.

The irony is that AI is genuinely useful for finding bugs. Security teams now run fuzzing and static analysis with machine learning models, and several startups sell automated vulnerability discovery to enterprises. What breaks is the incentive structure around disclosure: a bounty pays for a human's judgment and a working reproducer, and a model that produces neither still consumes the same reviewer time as one that does.

Open source projects are the most exposed. Their maintainers are often unpaid, and a bounty program is one of the few ways they get outside help auditing code that ends up inside commercial products. If reporting channels close or slow down, the flaws do not disappear; they simply sit unreported for longer.

For now, Google has not said when the program will resume or what eligibility rules might change. The likely fixes are the ones other programs are already testing: requiring a working exploit, capping submissions per researcher, or using automated triage to filter reports before a human sees them. Each of those shifts work back onto researchers, and each risks filtering out a real bug along with the noise.