Google has paused its Open Source Software Vulnerability Rewards Program. Starting October 1, the program has been frozen, with Google promising an update in the first quarter of 2027.

Reason? The official statement cites a “significant rise in AI submissions, the vast majority of which were invalid.”

Tom's Hardware reports that Google engineers and open source maintainers have been flooded with invalid reports and hallucinated content. Bug bounties were meant to reward people who seriously hunt for vulnerabilities, but now they've turned into an AI dumping ground.

This isn't the first time this issue has been raised. Last year, TechCrunch reported that cybersecurity experts warned AI slop was posing a serious risk to bug bounty programs. Now Google has confirmed it with its actions.

Interestingly, Google is also a leading player in the AI space. It pushes AI on one hand, while on the other, it has to pause a program due to AI-generated vulnerability reports. Ironic, isn't it?

For now, Google suggests participants consider its other bug bounty programs. As for open source projects themselves, maintainers can probably enjoy some peace and quiet for a while.


*Image Credits: DBenitostock / Getty Images*

Source: [TechCrunch](https://techcrunch.com/2026/10/04/google-froze-its-open-source-bug-bounty-program-due-to-a-significant-rise-in-ai-submissions/), [Tom's Hardware](https://www.tomshardware.com/tech-industry/artificial-intelligence/google-suspends-part-of-the-oss-vrp-bug-bounty-program-due-to-an-influx-of-invalid-ai-submissions-product-vulnerability-submissions-ended-october-1)