Google Pauses Open Source Bug Bounty Program Due to AI Spam

Google has temporarily halted submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) due to a surge in AI-generated bug reports. The program, launched in August 2022, incentivizes security researchers to disclose vulnerabilities in open-source projects maintained by Google, such as Golang, Angular, and Protocol Buffers. Rewards ranged from $100 to $31,337, with a focus on flaws impacting the software supply chain.

The suspension follows an influx of automated, often invalid submissions. Google clarified that the pause does not affect existing reports or supply chain submissions. Researchers can still submit patches through the Google Patch Rewards Program, which offers up to $15,000 for high-impact fixes, or report Cloud-related vulnerabilities via the Cloud VRP.

Google plans to reform the OSS VRP to address the issue and will provide an update in Q1 2027. The company has rewarded thousands of researchers with over $81.6 million since launching its first VRP in 2010. In 2025, it awarded a record $17.1 million to more than 700 researchers, a 40% increase from 2024.

Google is not alone in facing this challenge. Earlier this year, the maintainer of the curl utility ended its HackerOne bug bounty program due to AI-generated reports, and Intel removed financial rewards for security flaws reported on its Intigriti program. Microsoft has also warned of increased vulnerability discoveries aided by AI tools.