Google paused its open source bug bounty program due to AI-generated invalid reports

Summary

Google has suspended its open-source security bug bounty program as of October 1, 2026. The company cited a "significant increase" in AI-generated submissions that were largely invalid or hallucinations. An update to the program is expected no earlier than the first quarter of 2027.

Why it matters

This serves as a concrete, operational example of AI-generated content disrupting a critical security workflow. The issue is no longer a hypothetical concern. Content described as "AI junk" is eroding the channels responsible for patching and securing the open-source software that forms the internet's backbone. The indefinite suspension creates a genuine gap in vulnerability reporting for projects maintained by Google.

Highlights

• Google’s own engineers and open-source maintainers were overwhelmed by invalid or hallucination-based reports
• The suspension is indefinite (at least until the first quarter of 2027) and eliminates a formal incentive channel for discovering security vulnerabilities
• Cybersecurity experts had pointed to bug bounty programs as a risk for this issue a year ago

Critical take

The news content is weak: there is no data on submission volume, the percentage of invalid reports, or whether Google evaluated filtering or verification mechanisms before closing the program. The phrase "update in the first quarter of 2027" pushes accountability far beyond the news cycle. The text reads more like a brief announcement relay than investigative journalism.