Google Freezes Open Source Bug Bounty as AI Submissions Flood In

Google has frozen its open source bug bounty program, pointing to a significant rise in submissions generated with AI tools. The pause is the latest sign that automated reports are putting real strain on the programs meant to reward genuine security research.

Bug bounties work on a simple exchange. Researchers find vulnerabilities, report them responsibly, and get paid when the flaw checks out. That model depends on human reviewers sorting valid findings from noise. When the volume of reports balloons, and many of them are poorly verified or simply wrong, the review queue becomes the bottleneck.

The problem has a name in developer circles: AI slop. Language models can produce text that reads like a credible vulnerability report, complete with confident descriptions and plausible code references, even when no real bug exists. Submitting such a report costs almost nothing. Checking it can take a maintainer hours.

Google is far from the first to feel the squeeze. Open source maintainers and other bounty operators have complained for some time that floods of machine-written reports waste scarce volunteer and staff time. A freeze at a company with Google's resources suggests the issue has grown beyond what extra headcount can easily absorb.

The pause also raises a awkward question for the wider ecosystem. Open source software underpins much of the modern internet, and bounty money is one of the incentives that encourages skilled researchers to look at it closely. If programs shut down or tighten rules to defend against spam, honest researchers could lose a channel for recognition and payment.

Possible fixes are easy to list and harder to execute. Programs could require working proof-of-concept exploits, demand disclosure of AI assistance, charge small deposits for submissions, or lean on reputation systems that favor researchers with a proven record. Each approach adds friction, and each risks discouraging newcomers who have legitimate findings.

Google has not detailed when, or in what form, the program might return. For now, the freeze serves as a warning to other organizations running similar schemes. As AI makes it trivial to generate reports at scale, the cost of triage is shifting onto defenders, and bounty programs will have to adapt or risk being drowned out by their own success.