Google suspends open-source bug bounty programme after flood of AI-generated reports
Google has frozen product bug reports under its OSS VRP to curb a flood of AI-generated vulnerability reports. The news appeared in the press on 5 October 2026 and again on 10 October.
Who is affected and how
- senior developer
- As an open-source maintainer, triaging incoming reports is likely to be a bigger burden, so it is worth setting up filtering rules.
- startup founder
- If you run your own bug bounty programme, expect a flood of AI-generated submissions.
Sources
- AI slop submissions force Google to freeze its open-source bug bountyhelp net security · Oct 5, 2026
- Google Pauses Open-Source Bug Bounty Program After Flood of Invalid AI-Generated Reportscybersecuritynews · Oct 5, 2026
- Google Freezes Open Source Bug Bounty Until 2027 Due to AI Spam Floodandroid headlines · Oct 5, 2026
- Google pauses its open-source bug bounty after a flood of fake AI reportsmartin cid magazine · Oct 5, 2026
- AI slop submissions force Google to freeze its open-source bug bounty - Help Net Securityhelpnetsecurity.com · Oct 5, 2026
- Google Pauses Open Source Bug Bounty Over AI Spamandroidheadlines.com · Oct 5, 2026
- Google pauses its open-source bug bounty after a flood of fake AI reports – Martin Cid Magazinemartincid.com · Oct 5, 2026
- Google benches open source bug bounty program following ‘significant rise’ in AI submissions | TechRadartechradar.com · Oct 5, 2026
Machine-generated summary based on the titles and excerpts of the source articles. The facts come from the linked article.