TechCrunch reports Google paused its open source bug bounty program on October 1, citing a surge of invalid AI-generated reports. Restart details are due in Q1 2027.
What was announced
On October 4, TechCrunch reported that Google has paused its vulnerability reward program for open source software. The pause took effect on October 1, and Google is said to plan to share details about a restart in the first quarter of 2027.
According to the explanation quoted in the report, the reason is a significant rise in automated submissions, most of which are not valid. Participants are reportedly being pointed to Google's other reward programs in the meantime.
Background and context
A vulnerability reward, or bug bounty, program pays people who find and report security weaknesses in software. TechCrunch reports that the backdrop is a growing number of AI-generated reports that look plausible but contain errors, which increases the burden on the people who have to review them.
The same dynamic applies well beyond security. When AI can produce text and reports in bulk, the people receiving them spend more effort checking whether the content is true, whether that is a contact form, a stream of reviews, or a vendor deliverable.
TAKEAWAY
What this means for your project
If your team uses AI to draft content, research or reports, have a person verify the figures, names and steps before anything goes to customers or partners. If you run a website or web app, also check whether automated submissions to your contact forms are rising and whether your spam protection still works.