Google pauses an open-source bug bounty program after a surge in automated reports

A paid channel for open-source flaws goes quiet

Google has put on hold the program that paid outside researchers for vulnerabilities in its open-source software. An October 4, 2026 account reported that the company froze the Open Source Software Vulnerability Rewards Program, blaming a significant rise in submissions associated with artificial intelligence. The pause began on October 1.

The halt is bounded in language, not by a published restart date. In posts on X and on the program website, Google said it would provide an update in the first quarter of 2027. The same account also described the pause as lasting until next year. An update is a commitment to speak again, not a commitment to reopen intake, restore prior terms, or clear a backlog. None of those operational details is in the record.

Automated volume, as the company described it

The stated reason is the quality of the inbound queue, not a disclosed compromise of a named product. In its public posts, the company said, "This pause is due to a significant rise in automated submissions, the vast majority of which are not valid." That sentence identifies automation, a rise called significant, and a judgment that most of those submissions were not real findings. It names no vendor, no model, no submission count, and no dollar figure for awards.

The missing counts limit any attempt to size the event. A significant rise could be modest or extreme; the record does not say which. Vast majority is a description, not a percentage. What can be said without stretching the source is still material. Google judged the automated flow large enough, and invalid often enough, to stop this program rather than continue under the prior rules.

The reported burden on engineers and maintainers

A further account, which the October 4 report attributed to Tom's Hardware, said Google engineers and open-source maintainers were overwhelmed by reports that were invalid or that contained hallucinations. A hallucinated report, in this setting, asserts a defect or a consequence the software does not actually present. The reporting groups invalid and hallucinated submissions as the material that buried reviewers. It does not give a count of either kind.

A flooded queue is not the same thing as a failed security program, and the record does not collapse that distinction. Nothing in it says Google found a surge of confirmed vulnerabilities, an attack on its infrastructure, or a breakdown in patching flaws already accepted. The pressure falls on people who must decide which reports deserve engineering time, including maintainers of code Google releases for others to run. On present evidence, the pause stops paid intake through this channel until the company says more.

The decision has a public prelude. A year earlier, the same news organization reported that cybersecurity experts were warning of a serious risk to bug bounty programs from low-quality machine-generated output, sometimes called AI slop. The October pause is consistent with that warning. It is not confirmation of any expert's figures, none of which are restated here. It does show that automated submissions which do not survive review had already been described publicly as a threat to the bounty model.

Alternatives, and the limits of the record

During the pause, Google encouraged participants to consider its other bug bounty programs. The encouragement is real and limited. The record does not name those programs, compare their terms, or say whether a finding in Google's open-source code can be filed elsewhere and paid. Researchers who relied on the open-source channel have a suggestion, not a substitute arrangement.

Several operational questions are unanswered. It is not known how many reports were in review on October 1, whether they will still be assessed, or whether an award already earned but unpaid is affected. It is not known whether the company will return with tighter eligibility, stricter proof, or a smaller scope. Those are plausible responses to a flood of weak automation. They are not facts. The only forward-looking fact in the account is an update promised for the first quarter of 2027.

What the record supports, and what it does not

The reported facts are narrow and should stay that way. Google paused the Open Source Software Vulnerability Rewards Program as of October 1. It blamed a significant rise in automated submissions, the vast majority of them not valid. Engineers and maintainers were reported overwhelmed by invalid or hallucinated reports. Other Google bounty programs were suggested as alternatives. An update is promised in the first quarter of 2027. Award sizes, staffing, vulnerability totals, and market reactions are not in the record and should not be inferred.

What follows is analysis, not a further fact. A bounty is a market for verified information. Payment depends on a real finding, but review time is spent on every submission. If automated tools make weak reports cheap to produce, the cost of sorting can rise without a rise in true defects. Stopping intake is one rational response. Google has stopped intake in one open-source program. That does not show bounty markets failing across the industry, and it does not show a reduction in Google's other security work. It does show that submission quality had become a constraint large enough to halt this channel and leave the next design for a later update.

For organizations that depend on Google's open-source components, the useful question is narrower than the headline. Paid intake under this program is unavailable after October 1. Other routes are not described well enough to treat as equivalents, and coverage of any given project by the remaining bounty programs is unspecified. Until the promised update, dependency risk is a question of whether genuine flaws will still be reported and fixed. The account does not support a claim that they will not.

Source

TechCrunch published this record on 2026-10-04. Pennington Financial accessed it on 2026-10-09.