Google has paused its Open Source Software Vulnerability Rewards Program as of October 1 after a surge in automated submissions, most of which were invalid. The company said it will provide an update in the first quarter of 2027.

In posts on X and the program website, Google said it paused the program because of “a significant rise in automated submissions, the vast majority of which are not valid.”

Google said engineers and open source maintainers were overwhelmed by invalid bug reports and reports containing hallucinations. It encouraged researchers to consider its other bug bounty programs.

The move comes as bug bounty operators respond to low-quality AI submissions.

Bugcrowd, a US-based crowdsourced cybersecurity platform, announced policy changes to address “AI slop” submissions, while a Bitdefender article described Apple’s program as drowning in similar reports.

🔗 Source: TechCrunch