Google pauses open source bug bounties after flood of AI reports

Google has paused its reward programme for people who find security flaws in open source software, after being overwhelmed by reports generated by artificial intelligence, most of which turned out to be wrong.

The company said its Open Source Software Vulnerability Rewards Program had been paused from 1 October. "This pause is due to a significant rise in automated submissions, the vast majority of which are not valid," Google said.

What a bug bounty is

Bug bounty programmes pay security researchers for finding and responsibly reporting flaws in software, so they can be fixed before criminals exploit them. Google has run such programmes for many years and has paid out millions of dollars to researchers around the world.

The open source programme covered software whose code is publicly available and which is used by Google and many other organisations, including widely used libraries that sit inside countless apps and websites.

A flood of AI reports

According to the technology site Tom's Hardware, Google engineers and the volunteers who maintain open source projects were swamped with reports that contained invalid information or details invented by AI tools, often called hallucinations.

Checking each report takes time. When large numbers of reports turn out to be false, maintainers, many of whom are unpaid volunteers, can spend hours on work that achieves nothing, and genuine reports risk being overlooked.

AI slop

Cyber security experts have warned for more than a year that low quality AI-generated content, sometimes called AI slop, poses a risk to bug bounty programmes. Some people use AI tools to generate large numbers of reports in the hope that a few will earn a payment.

At the same time, AI tools can be genuinely useful for finding security flaws when used carefully by skilled researchers, and several companies have reported real vulnerabilities discovered with the help of AI.

What happens next

Google said it would provide an update in the first quarter of 2027. In the meantime, researchers are encouraged to use the company's other bug bounty programmes, which remain open.

Why open source matters

Open source software underpins much of the internet, from web servers to the encryption that protects online banking. Much of it is maintained by small teams of volunteers. Past incidents, such as the Heartbleed flaw in 2014 and the Log4j vulnerability in 2021, showed how a single bug in a widely used open source component can affect organisations around the world.

Advice for organisations

The UK's National Cyber Security Centre advises organisations to keep track of the software components they use, apply security updates promptly and have a clear process for people to report vulnerabilities to them. Many organisations publish a security contact on their websites for this purpose.

Skills in demand

Cyber security skills are in high demand, and universities in Birmingham, including Birmingham City University and Aston University, offer courses in the subject. Aston researchers have also been studying how criminals use technology to abuse and defraud people online.

Other programmes affected

Google is not the only organisation to struggle. The maintainers of several popular open source projects have publicly complained about a surge in low quality reports produced by AI tools, and some have changed their rules to ban or restrict automated submissions, or to require reporters to show that they have checked their findings by hand.