bug bounty programs

Google has temporarily paused its open source bug bounty program, which paid researchers for finding vulnerabilities in open source projects, after a surge in submissions generated by artificial intelligence tools. The company says many AI-written reports are low quality and waste reviewers' time. Security researchers are debating how bounty programs should handle automated submissions and verify genuine human findings.

Google is scaling back its open source bug bounty program following a flood of invalid, automated vulnerability reports. The company says low-quality AI-generated submissions have overwhelmed reviewers, prompting it to restrict the types of projects and issues eligible for rewards. Security researchers are debating the move, warning it could discourage legitimate reporting while acknowledging that automated scanning tools are straining bug bounty programs across the industry.

Google has suspended its open-source bug bounty program, citing a flood of AI-generated vulnerability reports. The company says automated tools are producing low-quality submissions that overwhelm reviewers, making the program unsustainable in its current form. Security researchers are debating what this means for legitimate disclosure and the growing noise from AI-assisted bug hunting across the industry.

Google has suspended its open source bug bounty program, citing a significant rise in AI-generated vulnerability submissions. The company says low-quality, automated reports have made it harder to identify genuine security issues worth rewarding. Security researchers are debating the change, with many pointing to the growing noise of machine-written bug reports overwhelming bounty programs across the industry.

Google has paused its open source bug bounty program, citing a surge of AI-generated vulnerability reports. The company says the flood of low-quality automated submissions is making it difficult to identify genuine security flaws worth rewarding. The move has drawn attention across the security community, which has been grappling with a wave of automated, often inaccurate bug reports produced with AI tools.

Google is pausing a lucrative bug bounty program that rewarded security researchers for finding flaws. Reporting indicates the decision relates to shortcomings in how AI handles vulnerability assessment, raising questions about relying on artificial intelligence for security work. Observers are weighing what the pause means for the broader bug bounty ecosystem and for trust in AI-driven security tooling.

Google has paused its open source bug bounty program after being overwhelmed by a wave of AI-generated vulnerability reports. The automated submissions have flooded reviewers with low-quality, often invalid findings, making the program difficult to manage. The move highlights a growing problem for security teams as generative AI tools make it easy to mass-produce bug reports that look plausible but waste researchers' time.