Google Pauses Open-Source Bug Bounty Program After Surge in AI-Generated Submissions

Google temporarily froze the program after a surge in submissions it believes were generated by AI. The likely concern is volume and quality control: AI-generated reports can be noisy, harder to verify, and increase reviewer workload, delaying real findings. The pause is intended to stabilize the intake process and ensure reported vulnerabilities are credible and actionable.

A pause in a specific bounty program doesn’t necessarily mean vulnerabilities can’t be reported at all. It mainly affects participation in the bounty workflow for that program during the freeze window. Researchers should still look for the platform’s standard vulnerability disclosure channels and follow Google’s current guidance for submitting security issues.

AI-generated submissions can increase the number of reports rapidly, but not all will contain real, reproducible vulnerabilities. Review teams may spend time validating claims, checking proof-of-concept quality, and filtering duplicates or speculative issues. This can create backlogs and reduce overall efficiency, which is why Google appears to be adjusting how submissions are handled.

Not necessarily. The core goal of bug bounties remains to reward legitimate security discoveries. However, Google may introduce tighter verification steps, improved submission requirements, or additional screening to distinguish genuine vulnerabilities from automated or low-quality submissions. The pause suggests enforcement and triage will be more strict until review capacity recovers.

The article describes the freeze as temporary, but doesn’t provide a firm duration in the excerpt. Researchers should monitor official updates from Google and program pages for restart timing and any changed submission rules. Expect process tweaks such as clearer proof requirements, better triage criteria, or updated guidance on what qualifies for bounty consideration.