Google paused its Open Source Software Vulnerability Rewards Program until 2027, citing a 'significant rise' in automated AI submissions that were largely invalid or hallucinated, overwhelming engineers and open source maintainers.
AI slop seems to be overwhelming bug bounty programs.
# Google froze its open source bug bounty program due to a 'significant rise' in AI submissions | TechCrunch
Source: [https://techcrunch.com/2026/10/04/google-froze-its-open-source-bug-bounty-program-due-to-a-significant-rise-in-ai-submissions/](https://techcrunch.com/2026/10/04/google-froze-its-open-source-bug-bounty-program-due-to-a-significant-rise-in-ai-submissions/)
In Brief
Posted:
1:31 PM PDT · October 4, 2026
**Image Credits:**DBenitostock / Getty ImagesBlaming a “significant rise” in AI submissions, Google has paused its open source bug bounty program until next year\.
Last year, TechCrunch reported that[cybersecurity experts were warning of that AI slop posed a serious risk to bug bounty programs](https://techcrunch.com/2025/07/24/ai-slop-and-fake-reports-are-exhausting-some-security-bug-bounties/)\. Looks like that’s the issue confronting Google’s Open Source Software Vulnerability Rewards Program, where researchers were rewarded for finding vulnerabilities in the company’s open source software\.
In posts[on X](https://x.com/GoogleVRP/status/2105689195180179605)and[the program website](https://bughunters.google.com/about/rules/open-source/google-open-source-software-vulnerability-reward-program-rules#reward-amounts), Google said the bug bounty program was paused as of October 1, with a promise to provide “an update” in the first quarter of 2027\.[According to Tom’s Hardware](https://www.tomshardware.com/tech-industry/artificial-intelligence/google-suspends-part-of-the-oss-vrp-bug-bounty-program-due-to-an-influx-of-invalid-ai-submissions-product-vulnerability-submissions-ended-october-1), Google engineers and open source maintainers were overwhelmed by reports that were invalid or contained hallucinations\.
“This pause is due to a significant rise in automated submissions, the vast majority of which are not valid,” the company said\.
In the meantime, participants are encouraged to consider Google’s other bug bounty programs\.
### Newsletters
Subscribe for the industry’s biggest tech news
## Related
## Latest in AI
Turso is retiring its bug bounty program due to an overwhelming influx of low-quality, AI-generated submissions, highlighting the growing challenge of AI slop in open source maintenance.
The Financial Times reports that the AI coding boom is overwhelming open-source maintainers with low-quality AI-generated contributions, draining the ecosystem. Concrete evidence includes cURL shutting down its bug bounty program, Ghostty banning AI code, and tldraw auto-closing PRs, alongside research showing reduced contributor engagement.
Bug bounty programs are being overwhelmed by a surge of low-quality AI-generated vulnerability reports, forcing platforms like HackerOne and Nextcloud to implement new filtering and validation measures. While the volume of submissions has jumped 76%, the rate of legitimate findings remains steady at 25%.
Google reports that criminal hackers utilized artificial intelligence to discover a critical software vulnerability, prompting the tech giant to intervene and mitigate the threat before mass exploitation could occur.
OpenAI has launched a Bug Bounty Program in partnership with Bugcrowd, offering cash rewards ranging from $200 to $20,000 for security researchers who discover and report vulnerabilities in OpenAI's systems.