Google Freezes Open Source Bug Bounty Over AI Slop

As reported by TechCrunch, Google announced the pause of its Open Source Software Vulnerability Rewards Program effective October 1. The company stated that the suspension is a direct result of a significant rise in automated submissions, the vast majority of which lack validity. According to Tom's Hardware, engineers and project maintainers became overwhelmed by reports containing hallucinations or false security flaws. Google intends to evaluate the situation and provide an update during the first quarter of 2027, while advising participants to look at its other active bug bounty tracks.

This development highlights growing industry concerns regarding artificial intelligence tools overwhelming security review processes with low-quality or fabricated data, known as AI slop. Cybersecurity experts previously warned that automated report generation poses serious risks to vulnerability rewards programs, which rely on accurate researcher findings to maintain software integrity. When maintainers spend time filtering through invalid automated claims, genuine security vulnerabilities may face slower review times.

Google's temporary freeze underscores the operational strain that automated content generation places on technical evaluation pipelines. An update regarding the program's status is expected in the first quarter of 2027.