Google pauses open-source bug bounty program amid rise in AI submissions

Google has paused its Open Source Software Vulnerability Rewards Program, citing a “significant rise” in automated submissions that were mostly invalid.

The pause took effect on October 1, according to posts on X and the program website. Google said it would provide “an update” in the first quarter of 2027.

The program rewarded researchers for finding vulnerabilities in Google’s open-source software. TechCrunch reported that Google engineers and open-source maintainers had been overwhelmed by reports that were invalid or contained hallucinations, citing Tom’s Hardware.

“This pause is due to a significant rise in automated submissions, the vast majority of which are not valid,” Google said.

Google encouraged participants to consider its other bug bounty programs while the open-source program is paused. The source does not specify when the program will resume.