Google Pauses Open Source Bug Bounty Program Following Significant Rise in Automated Submissions

Google paused its open source bug bounty program on October 1 because of a large increase in automated submissions. The company stated that most of these reports are invalid or contain hallucinations. Engineers and open source maintainers became overwhelmed by these automated entries. The Open Source Software Vulnerability Rewards Program previously paid researchers for finding flaws in Google software.

Google plans to share an update about the program during the first quarter of 2027. While the open source program is on hold, participants can look at Google's other bug bounty programs. Last year, experts warned that artificial intelligence tools posed serious risks to these vulnerability programs.