Google Pauses Open Source Bug Bounty for AI Reports

Google’s explanation for shutting the front door of its open source bug bounty is a single sentence: “This pause is due to a significant rise in automated submissions, the vast majority of which are not valid.”

That’s from the company’s own post on X, repeated on the program’s rules page. As of October 1, Google’s Open Source Software Vulnerability Rewards Program (OSS VRP) no longer takes new product vulnerability reports. The company says it will “give an update in Q1 2027.” It doesn’t say whether the program comes back, only that there will be news.

What’s closed and what isn’t

The freeze is narrower than some headlines make it sound. BleepingComputer, which quotes Google’s notice, lists what still works: reports about the supply chain (compromised build pipelines, tampered packages) are still accepted, anything filed before October 1 will be handled, and some Google Cloud repositories can still send bugs through the separate Cloud VRP. Google also points people to its Patch Rewards Program, which BleepingComputer says pays up to $15,000 for high-impact fixes.

What’s gone is the route most researchers actually used. Find a flaw in a public Google project such as Go, Angular or Protocol Buffers, write it up, get paid. The program launched in 2022 with payouts from $100 to $31,337, according to HWBusters.

Cheap to write, slow to check

Tom’s Hardware, as relayed by TechCrunch and others, reports that Google engineers and maintainers were buried in reports that described bugs which didn’t exist or couldn’t be exploited. I couldn’t open the Tom’s Hardware piece itself, so I’m taking that characterization from those summaries. Google’s own wording (“not valid”) is the part I can quote directly.

The economics are plain enough. A script can point a language model at a repository and produce a confident write-up, with a severity score, in minutes. A person still has to read it, try to reproduce it and close it. Writing a report costs almost nothing now. Checking one costs what it always did.

Google had already tried a softer fix. HWBusters says it rewrote the OSS VRP rules earlier this year to screen out low-quality reports. A full pause suggests that wasn’t enough.

Not the first one

The curl project ended its bug bounty in January after the same kind of flood, BleepingComputer notes. Google is a much bigger name, though, and it’s not a hobby project with one maintainer. It paid out a record $17.1 million to more than 700 researchers in 2025, up 40% from 2024, again per BleepingComputer. A program that size doesn’t pause lightly.

What I make of it

The irony is hard to miss. The same tools that fill the inbox with junk also find real bugs, and Google’s own AI bug hunter reported 20 genuine vulnerabilities in open source software last year, according to a TechCrunch report from August 2025 that HWBusters links. So the problem isn’t that machines can look for flaws. It’s that a bounty paying per valid report gives anyone with an API key a reason to submit everything and let the vendor sort it out.

I don’t know what Google will change. Required proof-of-concept code, invitation-only access or a cap on submissions are all guesses, and some outlets are already guessing. None of it is announced. What I’d watch is whether the Q1 2027 update puts the cost of checking back on the person submitting.

The same imbalance shows up elsewhere in AI right now. OpenAI says reading its own agents’ logs would take one person 66 million years, which I covered in the 50 petabytes story. Making AI output is easy. Verifying it is where the bill lands.

Google stopped paying for bugs in its open source code. Too many of the reports were AI-written and wrong.

What’s closed and what isn’t

Cheap to write, slow to check

Not the first one

What I make of it

Sources