Google Bug Bounty Program

Google has suspended its open source bug bounty program following a surge in AI-generated submissions. The company says automated tools are flooding the program with low-quality vulnerability reports, overwhelming reviewers and making it harder to identify genuine security issues. The move has sparked debate among security researchers about the impact of AI on bug bounty ecosystems.

Google is restricting its bug bounty program covering open source projects after a surge of low-quality, automated vulnerability reports flooded its review process. The company says AI-generated submissions, many invalid or low-value, have overwhelmed security teams, forcing it to narrow eligibility and tighten criteria for rewards. Security researchers are debating the move, with some warning that legitimate findings may now be overlooked as programs tighten rules across the industry.

Google has paused its open-source bug bounty program after receiving a flood of low-quality, AI-generated vulnerability reports. The influx of automated or copy-paste submissions has overwhelmed reviewers and made the program impractical to run. The move highlights a growing problem for bug bounty platforms as generative AI makes it cheap to mass-produce plausible-looking but useless security reports, drowning out legitimate findings from real researchers.

Google has suspended its open-source bug bounty program, citing a flood of AI-generated vulnerability reports. The company says automated tools are producing low-quality submissions that overwhelm reviewers, making the program unsustainable in its current form. Security researchers are debating what this means for legitimate disclosure and the growing noise from AI-assisted bug hunting across the industry.

Google has suspended its open source bug bounty program, citing a significant rise in AI-generated vulnerability submissions. The company says many of the reports flooding in are low-quality, machine-written findings that take up valuable reviewer time without adding real security value. The move has sparked debate among security researchers about the impact of automated tools on responsible disclosure programs and how bounty platforms should handle AI-created noise.

Google has paused its open source bug bounty program, citing a surge of submissions generated by AI tools. Low-quality automated reports are reportedly overwhelming reviewers, prompting the company to halt new submissions while it reassesses how to handle the influx. Security researchers are watching closely, as the decision raises broader concerns about AI-generated spam affecting vulnerability disclosure programs.