Google Bug Bounty Pause Exposes AI Slop Problem

The Google bug bounty pause is a warning about what automated tools can do to security work. Google has frozen its open source vulnerability rewards programme.

The suspension took effect on 1 October 2026. Google says it expects to share an update in the first quarter of 2027. In the meantime, it points researchers to its other bounty schemes.

The reason is volume. Google cited “a significant rise in automated submissions, the vast majority of which are not valid,” as TechCrunch reports. Engineers and maintainers faced floods of reports. Many contained invalid findings or AI-generated hallucinations.

How the Google bug bounty pause happened

Bug bounties work on trust. A researcher finds a flaw. The company checks it and pays a reward. Each report costs a human reviewer time.

Language models cut the cost of writing a report to almost nothing. They do not cut the cost of checking one. A tool can produce a confident, well-formatted claim about a bug that does not exist. A person must still prove it false.

That imbalance is the heart of the problem. Reward programmes pay for valid findings. They attract anyone who can generate plausible text at scale. Honest researchers then wait longer while reviewers drown in noise.

TechCrunch had warned of this risk in July 2025. The pause suggests the warning came true. Google has not published figures on how many submissions it received, so the scale remains unclear.

The cost falls on open source. Maintainers are often volunteers. They rely on funded programmes to find real flaws in code that millions of people use. A pause removes an incentive for careful human research.

There are fixes. Programmes can demand working proof-of-concept code. They can rate-limit new accounts and reward reporters with good track records. Whatever the method, the burden of proof must shift back to the sender.

Our recent report on open-weight models shows how fast these tools spread. Their reach is growing, and so are the side effects.

Security teams elsewhere should take note. Any open channel that pays for reports will face the same flood. Early filters and clear rules will matter more as automated tools improve.

Fact basis: TechCrunch (4 October 2026), citing Google’s Vulnerability Reward Program announcement.