Google Suspends Open-Source Bug Bounty Over AI Reports

According to a report by Infosecurity Mag, Google has temporarily suspended its Open Source Vulnerability Rewards Program following an influx of submissions attributed to artificial intelligence. The decision comes as the technology giant seeks to manage the quality and volume of incoming reports within its expansive open-source ecosystem.

The suspension affects the company’s initiative designed to incentivize security researchers to identify and disclose vulnerabilities in Google’s open-source projects. By pausing the program, Google aims to address the challenges posed by the recent flood of AI-generated submissions that have complicated the triage and verification process for its security teams.

Infosecurity Mag details that the pause is a direct response to the specific nature of the current submission wave. The publication notes that the volume and style of these reports differ significantly from traditional human-led vulnerability disclosures, creating operational strain on the resources allocated to reviewing and validating potential issues within the open-source estate.

The scope of the program covers a wide array of Google’s open-source contributions, which are utilized by developers and enterprises worldwide. The rewards program has historically served as a critical layer of defense, relying on community participation to maintain the integrity of widely adopted software libraries and tools.

This event highlights the growing intersection between automated security research tools and established bug bounty frameworks. As AI capabilities advance, organizations managing large-scale open-source projects are increasingly facing new categories of operational challenges related to signal-to-noise ratios in vulnerability reporting.

The report does not detail specific vulnerabilities found or the exact technical methods used by the AI systems involved. Instead, it focuses on the administrative and operational decision to halt reward distributions temporarily while Google evaluates the sustainability and impact of these automated submission trends on its security operations.