Google has suspended its bug bounty program for open-source software. The company says the reason for this decision is a significant increase in submissions and reports generated with the help of artificial intelligence. The program will be on hold until next year.
Suspension from October 1
Google announced in posts on X and on the program's official website that rewards have been suspended from October 1. The company also promised to publish a "update" on the future of the program in the first quarter of 2027.
Google explained that the pause was due to a significant rise in automated submissions, the vast majority of which are not valid.
A program victimized by "AI mistakes"
This program is the same Google open-source software vulnerability reward program where security researchers were paid for finding and reporting vulnerabilities in the company's open-source software.
According to reports, Google engineers and open-source project maintainers were faced with a flood of reports that were either invalid or contained AI "hallucinations"-claims of vulnerabilities that do not actually exist.
A warning that had been given beforehand
According to TechCrunch, last year cybersecurity experts warned that model errors in artificial intelligence could pose a serious threat to bug bounty programs. The issue is that AI tools can write technically formatted and convincing reports in seconds, but reviewing and rejecting each fake report takes hours of volunteer security teams' and maintainers' time.
Google has meanwhile advised participants to consider the company's other bug bounty programs. So the suspension currently applies only to the program related to open-source software.