Google Suspends Open‑Source Bug Bounty as AI‑Generated Reports Surge

Google announced it will temporarily halt its open‑source bug bounty program after observing a sharp increase in submissions generated by artificial‑intelligence tools, which it described as overwhelming the system.

The company said the volume of AI‑crafted reports has risen dramatically in recent weeks, straining the internal triage process and making it harder for security analysts to distinguish genuine vulnerabilities from low‑quality or duplicate findings.

Bug bounty initiatives, which reward external researchers for uncovering security flaws, have become a cornerstone of modern software defense. Google’s open‑source program, launched to protect the many libraries and frameworks it maintains, has historically attracted a diverse pool of independent security hunters.

According to the statement, the influx of AI‑produced submissions has not only inflated the number of entries but also lowered their overall reliability. “We are seeing a significant rise in AI‑derived reports that lack the depth and reproducibility needed for effective remediation,” the company wrote, adding that the current workflow cannot sustain the surge without compromising quality.

Industry observers note that the phenomenon reflects a broader trend: as large language models become more accessible, developers and hobbyists are using them to automate vulnerability discovery. While this can accelerate detection, it also creates noise that can drown out truly critical issues.

Google has not specified how long the pause will last, but it indicated that the company will use the downtime to refine its intake mechanisms, possibly incorporating automated filters or new verification steps to better manage AI‑generated content.

Security experts caution that the situation underscores the need for bounty programs to evolve alongside AI capabilities. “Programs must balance openness with the practical limits of human review,” said a cybersecurity analyst who asked to remain anonymous. “Otherwise, the signal-to-noise ratio becomes untenable.”

The suspension may prompt other tech firms to reassess their own reward schemes, especially those that rely heavily on community contributions. As AI tools continue to mature, the industry is likely to see more adjustments aimed at preserving the efficacy of vulnerability‑reporting ecosystems while leveraging the speed that automation can provide.