Google Halts Open Source Bug Bounty Program as AI-Generated Reports Rise

Google is putting part of its open-source security program on hold after a flood of automated bug reports made it harder to find the useful ones. The Google open-source bug bounty program stopped accepting new product-vulnerability submissions. The pause began on October 1, 2026. Google said the pause followed a “significant rise” in automated submissions, and most were not valid.

The freeze does not cover the full Open Source Software Vulnerability Reward Program. Outstanding reports are still covered, and supply-chain reports remain open. Google is also pointing researchers to other bug bounty programs. It plans to give an update in the first quarter of 2027.

The change applies only to new product-vulnerability reports. These reports cover security flaws in Google’s open-source projects. That detail matters. The program has not disappeared. Earlier reports remain in the system, while supply-chain reports continue.

The pause points to four changes in how bug bounty programs may handle the growing use of AI. Each one shows why finding more possible bugs does not always mean finding more real security threats.

1. The discovery race is faster: AI tools can scan code, spot patterns, and help prepare reports quickly.
2. The review work is still human. Teams must check whether a reported flaw is real, reachable, and linked to a real security risk.
3. Google saw the warning signs earlier. In March 2026, Google said it had seen a major rise in AI-generated reports. It then added stricter proof rules for some report types.
4. Q1 2027 is the next checkpoint. Google’s next update should show how it plans to filter weak reports without blocking serious researchers.

AI tools have made code review and report writing faster. A researcher can examine large codebases and prepare a report with less effort. That helps explain the Google bug bounty program AI submissions surge. But speed does not prove a security flaw.

For example, an AI system may flag a suspicious function and label it a vulnerability. A researcher still needs to show that the code can be reached, the issue can be reproduced, and the security impact is real.

Google said its earlier rule changes followed a rise in low-quality and invalid reports. Some AI-generated reports included wrong details about how a flaw might be triggered. Others found real coding errors but had little security impact. The bigger issue is clear. AI has made it faster and easier to raise a security claim, but proving that claim is still the key step.

The impact reaches the wider open-source world. Open-source software supports apps, cloud services, and infrastructure around the globe.

When maintainers spend more time filtering weak reports, they have less time to focus on confirmed security issues. That can add pressure to teams already handling large amounts of security work. Google’s move also sends a message to bug hunters. AI can help with research, but reports still need clear proof and real impact before they become useful to security teams.

Google has not said when new product-vulnerability reports will reopen. The Q1 2027 update is the next major checkpoint.

The areas to watch are stronger proof rules, better filters, and a greater focus on repetitive findings. Google’s March changes already moved the program toward stronger evidence and real-world impact. For researchers, the message is simple. AI can help find a possible bug. Proof still decides whether that bug matters.

Authors note:

The Google pause shows that AI is changing bug hunting faster than security teams can adapt. In the view of theNew York Press Release, the bigger challenge is not finding more bugs. It is making sure genuine threats do not get buried under automated noise.