search
Google Bug Hunters
Trends
- 1Google stops accepting product vulnerabilities in OSS bug bounty●Google no longer accepting product vulnerabilities submitted to the OSS VRP
Google has updated the rules of its Open Source Software Vulnerability Reward Program so that product vulnerabilities are no longer accepted under it. Security researchers will now need to report flaws in Google products through separate channels rather than the open-source program, and the change is being discussed among bug bounty hunters who track how rewards and scopes shift.
- 2
Google has paused its open-source bug bounty program, which paid researchers for reporting vulnerabilities in projects like Bazel, Angular, Golang, and Protocol Buffers. The company said it was overwhelmed by a flood of low-quality, AI-generated submissions from bounty hunters, making the program difficult to sustain. The move has sparked debate among security researchers about the impact of automated AI spam on vulnerability disclosure programs.
- 3Google freezes open source bug bounty amid surge of AI submissions▼Google froze its open source bug bounty program due to a 'significant rise' in AI submissions https://techcrunch.com/202
Google has paused payouts for its open source bug bounty program, citing a significant rise in AI-generated vulnerability reports. The company says the flood of automated, often low-quality submissions has overwhelmed reviewers, making it hard to identify genuinely useful findings. Security researchers are debating whether AI tools are drowning out human bug hunters and what this means for the future of crowdsourced security work.
- 4Google Pauses Bug Bounty Program, Citing AI Limitations●Google Is Pausing a Lucrative Bounty Hunter Program. The Reason Points to a Weakness With Using AI
Google is pausing a lucrative bug bounty program that rewarded security researchers for finding flaws. Reporting indicates the decision relates to shortcomings in how AI handles vulnerability assessment, raising questions about relying on artificial intelligence for security work. Observers are weighing what the pause means for the broader bug bounty ecosystem and for trust in AI-driven security tooling.