Open Source Vulnerability Reward Program

Google has temporarily frozen its open source bug bounty program, citing a significant rise in AI-generated submissions. The company says low-quality, automated vulnerability reports are overwhelming reviewers. The move highlights a growing problem for security teams as AI tools make it easy to mass-produce plausible-looking but often useless bug reports, forcing programs to reassess how they filter and reward legitimate research.

Google has paused its open source bug bounty program, citing a flood of AI-generated spam reports. The program paid security researchers for finding vulnerabilities in open source projects. Reports say low-quality, automated submissions made it difficult for reviewers to identify genuine findings, prompting the suspension while the company reassesses how the program is run.

Google has temporarily paused its open-source bug bounty program, which pays researchers for reporting security vulnerabilities in its open-source projects. The company reportedly suspended submissions after an explosive surge in reports overwhelmed the program, leaving the company unable to process them. Security researchers are watching closely to see whether Google will resume payouts or restructure the initiative.

Google has temporarily paused its open-source bug bounty program, which pays researchers for reporting security flaws in projects like Chromium and Bazel, after a wave of low-quality, AI-generated submissions flooded the system. The company says the volume of automated, invalid reports made it hard to review legitimate vulnerabilities, forcing the suspension.

Google has announced it is pausing its Open Source Vulnerability Reward Program through 2026. The program paid security researchers for finding bugs in Google's open-source projects, including Bazel, Angular, and Fuchsia. The pause means researchers cannot submit new reports for rewards during this period, and observers are questioning what the decision signals about Google's commitment to open-source security funding.

Google has temporarily paused its open source bug bounty program, citing a surge in submissions generated with AI tools. The company says low-quality automated reports have made it harder to identify genuine vulnerabilities worth rewarding. The move has sparked debate in the security community about whether AI-generated bug reports are overwhelming vulnerability disclosure programs across the industry, and when Google might resume the program.

Google has paused part of its Open Source Vulnerability Reward Program (OSS VRP), halting vulnerability search activities after a wave of AI-generated reports. The company is said to be dealing with a flood of low-quality or automated findings produced by artificial intelligence tools, prompting a temporary stop while it reassesses how such submissions are handled.