Artificial intelligence is creating a new kind of headache in cybersecurity. Google has temporarily suspended its bug bounty program for open-source software after being overwhelmed with automated reports, most of which turned out to be invalid.
The Program Being Suspended
The program in question is the Open Source Software Vulnerability Rewards Program (OSS VRP). Through this program, security researchers can earn rewards for discovering and reporting security vulnerabilities in Google’s open-source projects.
Google said the suspension took effect on October 1, 2026. The company plans to provide an update on the program’s future status in the first quarter of 2027.
“This temporary pause is due to a significant increase in automated reports, most of which are invalid,” Google said, as quoted by TechCrunch on Monday, October 5, 2026.
While the program remains paused, Google is advising security researchers to participate in its other bug bounty programs instead.
A Flood of AI-Generated Reports
This issue with AI-generated security reports isn’t new for Google. The company had already revised OSS VRP’s rules back in March 2026, after noticing a significant surge in AI-assisted reports.
At the time, Google identified two major problems. First, AI-generated reports were appearing that contained inaccurate information or outright hallucinations about how a particular vulnerability could supposedly be exploited.
Second, some reports did identify genuine code errors, such as buffer overflows, but these issues carried little to no actual security impact, since the flawed code either wasn’t reachable in practice or wasn’t relevant to the project’s overall security model.
Google emphasized that AI can actually be a genuinely useful tool for security researchers looking to identify potential vulnerabilities at scale. The real problem arises when AI-generated results get submitted directly without first being validated by a human researcher.
Google’s Earlier Attempts to Manage the Problem
Due to the flood of reports, Google had previously tightened its submission requirements. For certain high-priority projects, reports involving memory corruption issues now needed to include reproducible proof using OSS-Fuzz, or reference an already-merged patch. Google also reduced or eliminated reward payouts for several report categories on lower-priority projects.
However, these measures apparently weren’t enough to solve the underlying problem. According to TechCrunch, Google ultimately decided to pause OSS VRP entirely until sometime next year.
What This Reveals About AI in Cybersecurity
This situation highlights a complicated side of using AI in cybersecurity work. AI can genuinely speed up the process of searching for potential bugs, but its ability to generate large volumes of reports can also create what’s increasingly being called “AI slop,” content that looks substantive on the surface but ultimately just adds extra work for security teams who have to manually sort through and verify each submission.
This dynamic illustrates a broader tension emerging across the tech industry: AI tools can dramatically increase the volume of output, but without proper human oversight and validation, that increased volume doesn’t necessarily translate into increased value, and can sometimes create more work than it saves.
Google’s Other Security Programs Remain Active
Importantly, this pause doesn’t mean Google is shutting down all of its bug bounty initiatives entirely. What’s being suspended specifically is OSS VRP, the program dedicated to vulnerability reporting for Google’s open-source software projects. Google’s other security programs remain fully active, and researchers are still able to participate in those as usual.
What This Means for Security Researchers
For researchers who rely on bug bounty programs as a source of income or professional recognition, this pause serves as a clear signal that submission quality now matters more than ever, particularly as AI tools become more widely accessible.
Researchers using AI assistance to identify vulnerabilities would be wise to thoroughly validate findings manually before submission, rather than relying on raw AI output, both to maintain program integrity and to avoid having future submissions dismissed outright due to the kind of mass unreliability that led to this suspension in the first place.
As more companies grapple with similar challenges around AI-generated content flooding various reporting and review systems, Google’s experience with OSS VRP may serve as an early case study in how organizations need to adapt their verification processes for an era where generating large volumes of plausible-looking content has become dramatically easier than actually validating it.
