tech-google-freezes-bug-bounty-ai-submissions

Google Freezes Bug Bounty Program Over Flawed AI Submissions

The tech giant halted open-source product vulnerability filings on October 1 after invalid AI-generated flaw reports overwhelmed security engineers, promising an operational overhaul by early 2027.

Google paused open-source vulnerability submissions after automated AI spam overwhelmed security teams, promising an update by early 2027.

Essentially, Google froze open-source bug reports due to automated AI spam. Engineers stopped accepting product vulnerability submissions on October 1. Automated tools flooded security teams with invalid and fabricated flaw reports. Consequently, reviewers spent excessive hours checking fake issues instead of fixing software.

Surge in Automated Submissions Overwhelms Engineers

Specifically, the operational freeze targets the Open Source Software Vulnerability Reward Program (OSS VRP). Google launched this initiative to reward independent researchers for reporting genuine security flaws. In fact, finding software defects used to demand painstaking, manual human analysis. Large language models have now lowered the barrier for opportunistic hunters. Consequently, automated scripts began submitting thousands of low-effort, fabricated vulnerability claims to repositories.

Furthermore, maintainers faced severe triage exhaustion from checking these non-existent security flaws. Many reports proved to be mere AI hallucinations or benign syntax bugs. Therefore, staff lost critical hours that belonged to patching real-world exploits. As reported on TechCrunch, the sheer volume of invalid submissions broke normal triage workflows. The company decided that freezing public product intake was the only solution.

Critical Disclosure Channels Retain Key Exceptions

However, Google did not shut down its entire reward structure across all platforms. The freeze strictly limits product vulnerability reports filed after October 1. Specifically, valid reports submitted before the cutoff date will receive full reviews. Supply chain flaw reports under OSS VRP also remain completely active. Additionally, reviewers will process cloud security submissions through the distinct Google Cloud VRP.

Meanwhile, corporate security leaders warn that artificial intelligence changes traditional defense postures worldwide. This dynamic matches trends noted when Thales urged global firms to fight AI with automated tools. Modern developers require new safeguards against machine-driven data generation. For example, automated scanning agents can overwhelm human teams within minutes. Google advised bug bounty hunters to turn their attention toward other programs.

Industry-Wide Fatigue Strikes Open Source Platforms

Consequently, Google is not the only software organization grappling with automated reports. Similar disruptions hit major developer hubs throughout the broader tech ecosystem. For instance, Tom’s Hardware revealed that Linux maintainers faced similar AI-generated submission floods. Automated bots generated bogus vulnerability entries, pushing Linux kernel records to unsustainable highs.

Therefore, maintainers ended up dropping old network drivers to reduce unhelpful noise. In contrast to manual audits, automated bots lack critical security context. Industry platforms like HackerOne previously adjusted operations to handle automated submissions. As a result, software communities must redesign bounty incentives to survive rapid automation. Open collaboration models now face major challenges from untargeted AI scripts.

Structural Overhaul Planned for Early 2027

Subsequently, Google plans to rebuild its reporting protocols during this planned break. The security division announced it will share an official update by Q1 2027. In fact, future submission systems will likely demand working exploit proofs. Such verification filters would instantly block unverified language model responses. Platform managers also consider researcher reputation scoring to safeguard triage staff.

Ultimately, maintainers cannot afford to waste time reading AI-generated fiction. Google wants bug bounty programs to stay useful for genuine white-hat hackers. Until structural protections arrive, product bug queues inside the OSS VRP remain closed. The industry now watches closely to see how Google solves automated spam.