Google Bug Bounty Paused Into 2027 After AI Slop Flood
Google stopped taking product vulnerability reports for its open-source rewards program because most of what AI tools sent in was not real
The Google bug bounty for open-source code just went dark, and the reason is the same AI tools that were supposed to make security research faster. As of October 1, 2026, Google stopped accepting product vulnerability submissions to its Open Source Software Vulnerability Rewards Program, known as OSS VRP, after what it described as a significant rise in automated submissions that were mostly invalid. The program has paid researchers between $100 and $31,337 per finding since it launched in August 2022.
The Google bug bounty pause is narrow but telling. Supply chain reports and anything submitted before October 1 are still being handled, and researchers are being pointed to Google’s other reward programs, including Cloud VRP and the Patch Rewards Program, which pays up to $15,000 for high-impact fixes. Google says it will share how the program changes in the first quarter of 2027. Earlier this year it had already tightened the rules, asking for stronger proof such as an OSS-Fuzz reproduction or a merged patch for certain tiers.
Google is not alone. The maintainer of curl closed the project’s HackerOne bounty in January after a similar flood, Intel removed all financial rewards for software and hardware flaws on its Intigriti program in mid-September, and Linux has reportedly moved to drop support for some older network drivers because of false AI-generated bug reports. The pattern is simple: AI made writing a convincing vulnerability report nearly free, but a human still has to spend real time proving each one wrong.
Front Door Closed
Google stopped accepting OSS VRP product vulnerability reports on October 1, 2026, with an update promised for Q1 2027.
Cheap Reports, Costly Review
AI makes a convincing bug report nearly free to write, while every one still needs a human to verify or reject it.
Three Programs, One Year
curl ended its bounty in January, Intel removed all rewards in September, and Google paused its open-source program in October.
Proof Before Payout
Expect stricter evidence rules, like reproducible fuzzing results or a merged patch, before a report earns attention or money.
What the Google Bug Bounty Closed
The PauseOnly new product vulnerability submissions to the OSS VRP are closed. These cover code defects, logic flaws, and design bugs in Google’s public repositories, the part of the program that AI-assisted scanners could flood with the least effort.
Why AI Reports Break Triage
The ProblemLanguage models can produce confident write-ups, proof-of-concept code, and technical narratives that never correspond to an exploitable flaw. Reports have included hallucinated explanations of how a bug could be triggered, and each one still lands in front of an engineer or open-source maintainer.
A Wider Bounty Retreat
Industry Patterncurl shut down its HackerOne bounty in January. Intel dropped financial rewards on Intigriti in mid-September, after paying up to $100,000 per flaw. The Linux kernel is now handling close to a record 2,000 vulnerabilities per release as AI bug hunters comb roughly 40 million lines of code.
What Researchers Should Do Now
Action ItemsRoute open-source patches through the Patch Rewards Program and cloud findings through Cloud VRP while the Google bug bounty is rebuilt. Reproduce every finding on a current build, show real exploitability, and separate confirmed impact from AI-generated guesses before submitting anywhere.
The vast majority of which
are not valid
⚠️ Before You Read This as “AI Is Useless for Security”
1. The pause is temporary by Google’s own framing. The company says it is reworking the program and will share changes in Q1 2027, not ending it.
2. Not every motive is confirmed. Intel did not officially name AI reports as the reason it dropped rewards, though experts suspect it.
3. Real AI-found bugs exist too. The problem is unverified volume, not the use of AI by researchers who validate their findings first.