Google Pauses Open-Source Bug Bounty Program Amid Surge in AI-Generated Submissions
Summary
Google has temporarily stopped accepting submissions to its open-source bug bounty program, citing a significant rise in mostly invalid automated reports. The company has promised an update in Q1 2027.
Key points
- Google says most of the recent automated submissions to its OSS VRP are not valid.
- The article says a flood of low-quality, often AI-generated reports also led curl to end its HackerOne bounty program in early 2026.
- Intel reportedly has no bounties available on its new Intigriti program, amid concerns about AI-generated reports.
- The pause could reduce the time engineers and maintainers spend checking invalid reports, but may also discourage legitimate researchers.
- The article suggests proof-of-concept requirements, evidence thresholds, and rate limits as possible ways to manage submissions; Google has not announced redesign details.
- Google has promised an update in Q1 2027.
Article Details
- Event Type
- Temporary suspension of open-source bug bounty submissions
- Impact
- Google stopped accepting OSS VRP submissions after a significant rise in automated reports, the vast majority of which it said were invalid. The pause restricts legitimate researchers' ability to submit findings through the program. The article also reports that low-quality, often AI-generated submissions overwhelmed curl's small security team before it ended its HackerOne bounty program.
Vendors
GoogleCompanies like Google and Microsoft are finding much bigger numbers of vulnerabilities in their own products as a result of AI. But the same technology is leading to public reporting programs becoming overwhelmed by theHackerOneWe’ve seen this happen before. In early 2026, curl ended its HackerOne bounty program after low-quality, often AI-generated submissions overwhelmed its small security team.IntelIntel also launched a new bug bounty program on Intigriti but there are no longer bounties available, reportedly in order to stop a flood of AI generated reports.IntigritiIntel also launched a new bug bounty program on Intigriti but there are no longer bounties available, reportedly in order to stop a flood of AI generated reports.MicrosoftCompanies like Google and Microsoft are finding much bigger numbers of vulnerabilities in their own products as a result of AI. But the same technology is leading to public reporting programs becoming overwhelmed by the