Archive — US — techcrunch
Google froze its open source bug bounty program due to a ‘significant rise’ inAI submissions
Google has paused its open source bug bounty program due to a significant rise in automated AI submissions, which have been mostly invalid. This program was suspended as of October 1, with updates expected in the first quarter of 2027. The move highlights ongoing concerns in cybersecurity about AI-generated vulnerabilities.
Key points
- Google paused its open source bug bounty program due to a surge in AI-generated submissions.
- The program was halted as of October 1, with plans to update participants in Q1 2027.
- Cybersecurity experts previously warned that AI slop could threaten bug bounty initiatives.
- Most of the recent AI submissions are invalid or contain hallucinations, overwhelming Google engineers.
- Participants are advised to engage in Google's other bug bounty programs in the interim.
Why it matters
- The move aligns with growing concerns in cybersecurity about the reliability of AI in generating valid vulnerability reports.
- In 2025, IT trends emphasize the impact of AI on various sectors, including cybersecurity, raising questions about automation's reliability.
- Previous incidents have shown that AI-generated code can lead to significant vulnerabilities, affecting overall software security.
Google's suspension of its open source bug bounty program underscores the challenges posed by AI in cybersecurity, highlighting a need for improved validation and oversight amidst increasing automation.