Google pauses its open source bug bounty after a flood of AI generated reports

Google has stopped paying for new bug reports on its open source projects, and the reason is not a lack of bugs. The company paused its Open Source Software Vulnerability Rewards Program as of October 1, saying the pause was "due to a significant rise in automated submissions, the vast majority of which are not valid," TechCrunch reported.

In plain terms, the Google bug bounty for open source code got buried under AI generated reports that did not hold up. Google has promised an update in the first quarter of 2027, according to TechCrunch, BleepingComputer and Infosecurity Magazine.

What the Google bug bounty pause covers

The program, known as OSS VRP, launched in August 2022 and paid researchers between $100 and $31,337 per valid report depending on severity and how important the affected project is, BleepingComputer and Infosecurity Magazine reported.

Its scope was wide. BleepingComputer reported that it covered Google maintained projects including Golang, Angular, Bazel, Protocol Buffers and Fuchsia, along with critical third party dependencies and repository settings such as GitHub Actions workflows and access control rules.

TechCrunch reported that Google announced the pause on X and on the program's website. Engineers and open source maintainers had been dealing with a flood of invalid reports, many containing AI hallucinations, according to TechCrunch.

What still pays out

The pause is narrower than the headline suggests. According to BleepingComputer and Infosecurity Magazine:

• Reports filed before October 1 remain eligible.
• Supply chain reports under OSS VRP are still accepted.
• The Patch Rewards Program, which pays up to $15,000 for high impact fixes, continues, BleepingComputer reported.
• The Cloud VRP still covers vulnerabilities in Google Cloud open source repositories, per BleepingComputer.

TechCrunch also noted that Google pointed researchers toward its other bug bounty programs while this one is on hold.

Why AI reports are breaking bug bounties

A bug bounty works on a simple bargain. Outside researchers find real flaws, report them privately and get paid. The company fixes the problem before attackers find it. The system depends on reports being worth reading, because every submission costs a human reviewer time.

AI tools changed that math. It is now cheap to generate a report that looks plausible: correct formatting, confident language, a code snippet and a severity rating. Checking whether the described flaw actually exists still takes an engineer's time. When thousands of those reports arrive and most are wrong, reviewers spend their days disproving fiction, and genuine reports wait in the same queue.

TechCrunch pointed back to its own July 2025 reporting that warned AI generated content posed serious risks to bug bounty programs. Fifteen months later, one of the best known programs has hit pause.

Google is not alone. BleepingComputer reported that the curl project ended its HackerOne bug bounty in January 2026 over similar AI spam, and that Intel removed financial rewards from its Intigriti program in mid September 2026.

The money involved

Bug bounties are not a side project at Google. BleepingComputer reported that Google has paid more than $81.6 million across all of its vulnerability reward programs since 2010, and that it paid a record $17.1 million to more than 700 researchers in 2025, up from $12 million in 2024.

That context makes the pause notable. A company willing to pay that much for real findings decided that the open source program, in its current form, was not getting enough of them through the noise.

Who this affects

Security researchers. People who hunt bugs in Google's open source projects lose a paid channel for new reports until the program returns. Careful researchers end up paying for the behavior of mass submitters.

Open source maintainers. The maintainers of the affected projects were already absorbing the review load, according to TechCrunch. A pause cuts the incentive to spam, but it also cuts the incentive for legitimate research.

Everyone who uses the software. Projects like Go, Angular and Protocol Buffers sit underneath a large share of modern applications. Fewer eyes on that code, even temporarily, is not ideal. The upside is that real vulnerabilities can still be reported through Google's other channels, and supply chain reports still count.

What a fix might look like

Google has not said how it will rebuild the program. Infosecurity Magazine reported that the company plans to "reformat" it. Options other programs have discussed in general include requiring a working proof of concept, limiting submissions per account, building reputation systems that favor researchers with a track record, or charging a small deposit that is refunded for valid reports. Each one trades openness for signal.

There is an irony here. AI tools are getting genuinely good at finding real bugs, and the same tools are producing the junk that is overwhelming reviewers. The difference is whether a human with expertise checks the output before hitting submit. Our explainer on AI agents and where they still fail covers why confident output is not the same as correct output.

What it means for your security

For most readers, this is not a reason to worry about Google software today. The code has not changed and existing reports are still being handled. But it is a reminder that the security of everyday apps rests on a fragile pipeline of volunteers, maintainers and paid researchers.

When that pipeline slows, patching speed matters even more. Recent incidents such as the Citrix NetScaler zero days show how quickly attackers move once a flaw is known. On your own devices, the basics still do the most work: keep software updated, use a password manager, and take ten minutes to lock down your online accounts.

What to watch next

• The Q1 2027 update. Whether Google reopens the program with stricter submission rules or a different structure.
• Other programs. Whether more companies follow curl and Intel in cutting or pausing payouts.
• Platform changes. Whether bug bounty platforms add their own filters for automated reports.

For more security and big tech news, see our tech coverage.

Frequently asked questions

Why did Google pause its open source bug bounty?

Google said the pause was due to "a significant rise in automated submissions, the vast majority of which are not valid," according to TechCrunch.

When will the program come back?

Google has said it will provide an update in the first quarter of 2027, TechCrunch and Infosecurity Magazine reported.

Can researchers still report bugs in Google open source projects?

Yes. Reports filed before October 1 remain eligible, supply chain reports are still accepted, and the Patch Rewards Program and Cloud VRP continue, according to BleepingComputer.

How much did the program pay?

Rewards ranged from $100 to $31,337 per report, BleepingComputer and Infosecurity Magazine reported.