Google pauses open source bug bounty program over invalid AI submissions
What happened
TechCrunch reported on October 5 that Google paused its open source software bug bounty program, effective October 1, after a sharp rise in automated AI submissions. Google says the vast majority of the automated reports are invalid. Tom's Hardware reported that invalid or hallucinated vulnerability reports are overwhelming engineers and open source maintainers. Google encourages participants to look at its other bounty programs for now and promises an update in the first quarter of 2027. No restart date has been announced.
Written by AI from the coverage · updated 4 hours ago
Coverage
Follow the reports to see the story from different sides.
- TechCrunch · AIGoogle froze its open source bug bounty program due to a ‘significant rise’ in AI submissions
Google 因 AI 自动提交显著增加，暂停了其开源软件漏洞赏金计划，称绝大多数自动提交无效。暂停自 10 月 1 日起生效，Google 承诺在 2027 年第一季度提供更新。据 Tom’s Hardware 报道，无效或含模型幻觉的报告令工程师和开源维护者不堪重负；Google 鼓励参与者暂时考虑其其他漏洞赏金计划。
Heat over time
Heat now 9·Comparable peak 10（Oct 5 05:00）·Comparable change over 24 hours –
The trend only compares accounts observed without gaps, so its range may be smaller than the current heat. Hover or tap the chart for each hour; the left and right arrow keys step through it.