Google halted its Open Source Software Vulnerability Rewards Program on October 1, citing a surge in AI-generated bug reports that overwhelmed reviewers with invalid submissions and hallucinations.
The company announced the pause on X and its program website, stating the program would resume in the first quarter of 2027. Google said the freeze was prompted by "a significant rise in automated submissions, the vast majority of which are not valid."
According to Tom's Hardware, Google engineers and open source maintainers faced a backlog of reports containing false positives and fabricated technical claims. The pause prevents researchers from submitting new vulnerability reports to Google's open source projects during this period.
This shutdown reflects warnings cybersecurity experts raised last year about AI-generated "slop" destabilizing bug bounty ecosystems. Such programs typically incentivize security researchers to find and report vulnerabilities before attackers can exploit them. Large-scale submissions of low-quality, AI-hallucinated reports consume reviewer time and obscure legitimate findings, degrading the program's effectiveness.
Google encourages affected participants to use its other bug bounty programs instead, which cover different product categories and remain active. The company has not detailed how it will filter or validate submissions when the open source program reopens next year, or whether it will implement automated screening to reduce AI-generated noise.