AI written fake bug reports got so bad Google paused a bounty
Key takeaways
- Google suspended product vulnerability submissions to its open source bug bounty from 1 October after a flood of AI generated reports.
- Supply chain reports are unaffected, so the pause targets one category of submission rather than the whole program.
- Reviewing fake reports costs volunteer time, which is the scarce resource in open source security.
Last updated: 5 October 2026
From 1 October, Google stopped accepting product vulnerability submissions to its open source bug bounty. The reason, according to reports, is a flood of hallucinated, AI generated bug reports that took more time to read than to dismiss.
Supply chain reports are unaffected, so the pause is narrow and the rest of the program carries on. It still says something broader about what cheap generated text does to security work.
Why a bounty breaks under volume
A bug bounty pays for real flaws, and every submission has to be checked by a person. When a model can write a confident, well formatted report in seconds, the cost of sending one drops to almost nothing while the cost of reading it stays the same.
Some of those reports describe bugs that do not exist, with plausible code snippets and made up function names. A reviewer has to reproduce each claim before rejecting it, and that takes real time.
Who pays for it
The people absorbing this are mostly volunteers and small maintainer teams who look after code that much of the internet depends on. Every hour spent disproving an invented flaw is an hour not spent fixing a real one.
That matters at a moment when real flaws are arriving in bulk, as the numbers in Microsoft's 974 CVE Patch Tuesday and the Cisco email gateway vulnerability both show.
What to watch next
Google has not said how long the pause will last, and we have not seen a restart date.
Watch for how the pause ends. The likely options are stricter submission rules, proof of concept requirements or a reputation system, each of which makes honest reporting a little harder for newcomers.
The quiet cost is the human side. A bounty that tightens up to survive spam may also screen out the first time reporter who found something real, which tells you how expensive the spam has already become.
