Google has officially suspended its Open Source Software Vulnerability Rewards Program, effective October 1, 2026. The tech giant announced that the initiative will remain on hiatus until at least the first quarter of 2027, citing an unsustainable influx of low-quality, automated submissions.<\/p>\n
The decision follows long-standing warnings from cybersecurity professionals regarding the dangers of AI-generated “slop”-content produced by artificial intelligence that lacks human oversight and technical accuracy. While bug bounty programs are designed to incentivize ethical hackers to identify genuine security flaws, the rise of generative AI tools has enabled bad actors and automated scripts to flood these platforms with noise.<\/p>\n
According to reports from Tom\u2019s Hardware<\/em>, the sheer volume of submissions has created a bottleneck for Google\u2019s engineering teams and open-source maintainers. Instead of receiving actionable intelligence, reviewers are being buried under a mountain of invalid reports and AI-generated hallucinations that mimic the structure of a vulnerability report without providing any actual security value.<\/p>\n The core issue lies in the democratization of vulnerability scanning. While legitimate researchers use sophisticated tools to find real-world exploits, the current wave of automated submissions often relies on AI models that guess at potential bugs. This creates a “signal-to-noise” crisis: <\/p>\n This trend mirrors broader challenges in the tech industry, where platforms are increasingly struggling to distinguish between human-verified research and machine-generated spam. As of 2026, industry data suggests that some open-source security platforms have seen a 300% increase in automated, low-quality submissions compared to previous years, forcing companies to rethink how they verify incoming data.<\/p>\n While the Open Source Software Vulnerability Rewards Program is currently frozen, Google has clarified that this pause does not affect its other security initiatives. The company is encouraging researchers to redirect their efforts toward Google\u2019s remaining active bug bounty programs. By focusing on these alternative channels, the company hopes to maintain a high standard of security research while it develops a more robust strategy to filter out AI-generated noise before the program\u2019s anticipated return in 2027.<\/p>\nWhy Automation is Breaking Bug Bounty Models<\/h3>\n
\n
What\u2019s Next for Security Researchers?<\/h3>\n