Automated Floodgate: Google Freezes Open Source Bug Bounty to Block AI Slop

Google hit the pause button on its Open Source Software Vulnerability Rewards Program after an overwhelming surge of low-quality, automated vulnerability submissions flooded its review pipeline. Security teams confirmed the temporary freeze across social media channels and official developer portals, stating that operations will remain suspended until early 2027 while engineers rebuild their intake framework.

The sudden operational freeze highlights a growing crisis across open source security maintenance. Security researchers previously warned that automated text tools and artificial intelligence agents would flood bug bounty portals with generated vulnerability reports. That prediction came true as bounty hunters deployed automated tools to scan source code repositories and mass-produce vulnerability tickets to chase cash rewards.

Rather than discovering actionable security flaws, these automated scans generated massive volumes of invalid reports. Open source maintainers and Google engineers found themselves wasting hundreds of hours reading through hallucinated vulnerability claims, fake proof-of-concept steps, and non-existent security risks. Sorting through endless pages of generated filler forced Google leadership to halt the open source reward initiative entirely to protect developer productivity.

Google explicitly cited the massive rise in automated submissions as the main cause behind the shutdown, noting that the overwhelming majority of incoming reports proved completely invalid. While the open source program remains offline, security researchers looking to report legitimate software flaws are being directed toward Google’s traditional vulnerability reward channels. However, open source projects that rely heavily on external security audits now face a temporary gap in community vulnerability reporting.

Flooding security reward programs with automated slop exposes fundamental flaws in current bug bounty models. When low-cost automation tools let bad actors send thousands of synthetic vulnerability claims per day, manual review processes break down rapidly. Program managers cannot evaluate legitimate reports efficiently when forced to filter out thousands of hallucinated security tickets every single week.

Restoring trust in public bug bounty programs requires engineering teams to build strict verification filters before human reviewers inspect submissions. Security portals will likely begin mandating verified identity checks, automated code execution tests, and strict penalties for submitting fake vulnerability claims. Without automated validation layers, crowd-sourced security programs cannot survive the wave of synthetic spam hitting open source repositories.

Google’s decision to freeze its open source reward program signals a turning point for global software security. Open source maintainers cannot maintain project velocity while acting as manual filters for automated spam engines. Rebuilding the bug bounty intake process with automated testing pipelines ensures that legitimate security researchers get paid for real bug hunting while keeping open source software safe from digital noise.