Google freezes part of its open source bug bounty after a flood of AI slop reports

[TheGame_Fan]

Google stopped accepting product vulnerability submissions to its Open Source Software Vulnerability Reward Program on 1 October, Tom's Hardware reports. The reason is a flood of invalid bug reports generated by AI. The programme pays security researchers for finding flaws in Google's open source projects, but large language models and automated bug hunting tools have made it trivially easy to file reports. Many of those reports contained "completely invalid or unexploitable hallucinations"

Maintainers "were reportedly being overwhelmed by thousands of these poorly written reports". Engineers ended up spending their time checking code for imaginary flaws instead of fixing real ones. The suspension does not affect reports already submitted, or reports about supply chain vulnerabilities. Google says it will give an update by the first quarter of 2027

Google is not alone. Linux kernel maintainers have said they are "completely overwhelmed" by AI generated vulnerability submissions, which have pushed kernel vulnerability counts to record levels. Intel has suspended its own bug bounty, which paid up to 100,000 dollars per flaw. Bug bounties work because they reward people for finding real problems, but AI makes it almost free to submit hundreds of plausible looking reports in the hope that one pays out

There is an irony here. AI tools are helping some security researchers find real bugs faster, and several AI companies promote their models as security assistants. But the same tools let low effort submitters spam programmes at a scale that breaks them. It is a similar story to the arXiv submission limits and the councils drowning in AI written complaints that we have discussed recently

How should bug bounty programmes adapt to AI generated submissions? And is this another sign that AI is making open source maintenance harder rather than easier?

Google freezes open-source bug bounty program amid flood of invalid AI slop submissions - product flaw submissions halted until 2027 as maintainers drown in hallucinationswww.tomshardware.com

[Crossing36]

Open source maintainers already work for little or nothing. Now they have to wade through thousands of fake bug reports as well. No wonder some are burning out

Some of the biggest projects rely on a handful of volunteers. Losing their time to fake reports is a real cost to everyone who depends on that software