Many major technology companies run bug bounty programs that pay researchers and security professionals who discover and report vulnerabilities or bugs in software and systems. Such programs incentivize continuous security testing, allow companies to learn about and fix issues promptly, and reduce the incentive for finders to exploit or sell vulnerabilities.
Google has temporarily suspended its Open Source Software Vulnerability Rewards Program. According to coverage in TechCrunch and reporting by Tom's Hardware, the company was overwhelmed by a large number of false or AI‑hallucinated automated vulnerability submissions. These spurious reports prompted the pause while Google addresses the surge.
Google says it plans to relaunch a “refreshed” version of the program in the first quarter of 2027, but the company has not disclosed what specific changes it will make to prevent a recurrence of the problem or how it will verify the authenticity of submissions going forward.
The suspension highlights a broader challenge introduced by automated tools and generative artificial intelligence in vulnerability reporting: while such tools can speed up discovery and scale testing efforts, they can also flood reporting channels with inaccurate or fabricated findings that divert resources from real security issues.
In practical terms, the pause means that new submissions to this Google program will not be eligible for rewards until the company reopens the program in its updated form — currently scheduled for Q1 2027.
Why this matters
- Bug bounty programs play a key role in maintaining software security, particularly within open‑source ecosystems.
- A surge of AI‑generated false reports increases noise and reduces efficiency, potentially delaying the identification and remediation of real vulnerabilities.
- Google’s decision may serve as a precedent for other large organizations facing similar challenges as they integrate generative AI into security workflows.
Further specifics about the program’s redesign and the mechanisms Google will use to filter automated or inauthentic reports are expected to appear in future company communications.
