For years, Google paid researchers to find holes in the open-source software it maintains. The deal was simple: send in a real vulnerability, get a reward. On October 1, the company stopped taking the reports. The problem was not that the researchers stopped sending them. It was that machines started sending too many.
Google has suspended new product-vulnerability submissions to its Open Source Software Vulnerability Rewards Program, the long-running program that paid outsiders for flaws in projects such as Golang, Angular, Bazel, Protocol Buffers and Fuchsia. The reason, stated plainly in a notice on the program’s site: “a significant rise in automated submissions, the vast majority of which are not valid.”
The flood is a direct consequence of generative AI. Researchers, and people who are not researchers, have begun using models to scan code and draft vulnerability reports. The reports arrive looking credible, with severity ratings and proof-of-concept snippets attached. Many turn out to be hallucinations, describing exploits that do not work or flagging functions that cannot actually be reached. Every one still has to be read, reproduced and dismissed by a human.
That is the part that broke the economics. A bug bounty works because the cost of writing a good report is high enough that only serious people bother. AI drove that cost toward zero, while the cost of verifying a report stayed exactly where it was. Google engineers and the maintainers of open-source projects were left sorting through thousands of submissions, spending more time discarding bad reports than fixing real bugs.
The program has been running since 2022 and pays on a sliding scale that rises with the severity of the flaw and the importance of the project. The richest rewards go to supply-chain compromises that let an attacker tamper with build artifacts or package registries, with top-tier projects paying in the tens of thousands of dollars. That structure was designed to attract deep, patient work. What it attracted in recent months, instead, was volume.
The company had seen it coming. Earlier updates to the program’s rules had already warned researchers about AI-generated reports with incorrect trigger conditions and invented exploit paths. Google tried tightening the evidence requirements, asking for reproducible steps and realistic impact. The volume kept rising anyway, and the pause is an admission that filtering was not enough.
The suspension is narrower than it sounds. Google is still accepting supply-chain vulnerability reports, which cover tampering with build pipelines and packages, and it will keep processing product-vulnerability reports filed before October 1. Researchers can still submit patches through the Patch Rewards Program, which pays up to $15,000 for high-impact fixes, and some issues in Google Cloud repositories can go through the separate Cloud VRP. The carve-outs suggest the company is trying to protect the signals it still trusts while shutting off the noise.
Google said it will keep reworking the program and has promised an update in the first quarter of 2027. The wording is careful: an update, not a reopening. The company left itself room to redesign the intake process, tighten what counts as a valid report, or leave the product-vulnerability channel closed if the problem persists.
The irony is hard to miss. Google has spent heavily on using AI to secure its own code, and in September it detailed an internal agent, built on its Gemini models, that hunts for vulnerabilities in web applications and validates them before reporting, with a near-zero false-positive rate. The same technology that helps Google find bugs internally is, in the hands of the public, flooding its external program with noise. The difference is discipline: the internal agent verifies before it speaks, and the external submissions mostly do not.
The decision is being read across the security industry as an early, public admission that AI-generated submissions have become a structural problem rather than a nuisance. Companies that run similar programs have seen the same wave, and several have tightened their rules quietly rather than announce a pause. Google’s willingness to say the problem out loud, and to shut the door while it rethinks the intake, may give cover to other programs to do the same.
The strain fell heaviest on the people least equipped to absorb it. Many of the projects covered by the program are maintained by small groups of volunteers, and a flood of plausible-looking reports landed on their queues at the same time it landed on Google’s own security team. Sorting good from bad became a second job, and a thankless one, which is precisely the kind of friction that burns out the maintainers open-source software depends on.
For the researchers who did the work properly, the suspension is a loss. A program that paid for careful, verified findings in widely used code is now closed to their submissions for at least a quarter, with no promise of a return. The cost of the AI-generated flood, in the end, is being borne by the people who never sent a bad report.
