Since 1 October, the OSS Vulnerability Rewards Programme has been put on hold: the flood of automated reports, the vast majority of which were invalid, was overwhelming the engineers and maintainers.
Google has paused, as of October 1, its Open Source Software Vulnerability Rewards Program, which rewards researchers who discover flaws in the company's free software. The reason given was a sharp increase in automated submissions, the vast majority of which turned out to be invalid. Google engineers and project maintainers found themselves drowning in reports riddled with hallucinations produced by AI.
An update promised in early 2027
The announcement was made on X and on the program's website. Google promises to give news in the first quarter of 2027 and invites researchers to turn to its other bounty programs until then.
The phenomenon is not new: as early as July 2025, cybersecurity specialists warned of the pressure that low-quality AI-generated reports put on bug bounty programs. The fact that a player the size of Google is freezing its own shows that the problem has changed scale.
Read the full article on the original source
Go to the source →