Google froze its open source bug bounty program due to a ‘significant rise’ in AI submissions - TechCrunch

There is something exquisitely on-brand about Google shuttering its Open Source Software Vulnerability Rewards Program because of AI. The program — the one that pays people to find the holes in the software the world runs on — paused on October 1, with Google citing "a significant rise in automated submissions, the vast majority of which are not valid." So the machines are generating fake vulnerabilities faster than humans can triage the real ones, and the company that builds a fair few of those machines has concluded the sensible response is to shut the door and have a think. The bug bounty, an idea built on the assumption that strangers are sentient and mildly greedy, has met a stranger that is neither.

The remedy is a promise to provide "an update" in the first quarter of 2027. Not a fix, not a relaunch — an update, the word you reach for when you want the calendrical equivalent of a shrug. The program is paused "until next year," which gives everyone a comfortable stretch of time to forget it ever existed. Somewhere between October 1 and the promised Q1 2027, someone will presumably decide whether the answer is better filtering, a toll booth on submissions, or quietly not bringing the program back in quite the same shape. Google hasn't said which, which is itself the most informative thing it's said.

The genuinely grim part isn't the slop, it's the triage. A bug bounty's binding constraint has always been the humans reading the reports, and AI has now demonstrated that the cheapest commodity on earth is plausible-looking text. Every hour spent dismissing automated nonsense is an hour not spent patching the open source libraries that everything else quietly leans on. Google sells the fire hose and has now paused the drains. "An update" in Q1 2027, then. Do keep an eye on the status page.