Google Pauses Open-Source Bug Bounty Due to AI-Generated Reports

Google has announced that it will temporarily suspend its open-source bug bounty program, citing a significant increase in AI-generated reports, most of which are invalid. This has put a strain on the internal engineering team and open-source maintainers.

The program, which rewards security researchers for discovering vulnerabilities in Google’s open-source projects, has seen a surge in automated reports generated by AI tools. These reports are often filled with invalid content or fictional vulnerabilities, making it difficult for the review team to operate normally.

Google plans to provide further updates in the first quarter of 2027 and encourages participants to consider joining other bug bounty programs offered by the company.