{"id":920363,"date":"2026-10-04T14:16:24","date_gmt":"2026-10-04T14:16:24","guid":{"rendered":"https:\/\/www.newsbeep.com\/ca\/920363\/"},"modified":"2026-10-04T14:16:24","modified_gmt":"2026-10-04T14:16:24","slug":"google-freezes-open-source-bug-bounty-program-amid-flood-of-invalid-ai-slop-submissions-product-flaw-submissions-halted-until-2027-as-maintainers-drown-in-hallucinations","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ca\/920363\/","title":{"rendered":"Google freezes open-source bug bounty program amid flood of invalid AI slop submissions \u2014 product flaw submissions halted until 2027 as maintainers drown in hallucinations"},"content":{"rendered":"

Google<\/a> has officially suspended product vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP) \u2014 a bug bounty program \u2014 over an influx of invalid AI-driven reports. The company, in an official X post on October 1, encouraged participants to explore other VRP programs and committed to providing an update by the first quarter of 2027, while it reformats and works on this aspect of the program in the meantime.<\/p>\n

Go deeper with TH Premium: AI shortages<\/p>\n

\n

\"Nvidia\"\n<\/p>\n

(Image credit: Nvidia)<\/p>\n

The suspension went into effect on October 1 \u2014 the day of the announcement \u2014 and does not affect product vulnerabilities submitted before that date. Google said it may still accept reports covering product vulnerabilities through the Cloud VRP, \u201cfor some Google Cloud repos impacting Google Cloud products.\u201d The suspension also does not affect OSS VRP supply chain reports. In a similar case, Linux ended support for older network drivers due to an influx of false AI-generated bug reports<\/a>.<\/p>\n

<\/p>\n

OSS VRP is a specialized Google security bounty program<\/a> that incentivizes independent researchers to find and responsibly disclose security<\/a> flaws across Google’s open-source ecosystem. Under this program, product vulnerability submissions focus on code defects, logic flaws, or design bugs within Google’s public repositories. This was usually painstaking, manual work requiring skill. However, the rise of large language models<\/a> (LLMs) and automated AI bug-hunting scripts has nearly eliminated the cost and effort the task required, leading to an influx of low-effort, AI-generated bug reports.<\/p>\n

Latest Videos FromTom’s Hardware<\/p>\n

Google engineers and open-source maintainers were reportedly being overwhelmed by thousands of these poorly written reports that claimed to find bugs but were actually completely invalid or unexploitable hallucinations. They ended up spending too much time manually validating code instead of actually fixing real, critical vulnerabilities. This is what has led to the suspension of the program.<\/p>\n

Similar scenarios have been playing out across the industry. Earlier this month, Linux maintainers said they were \u201ccompletely overwhelmed\u201d by CVE finds<\/a> after AI-powered bug hunters pushed the Linux kernel to a record 2,000 vulnerabilities per release. Intel also suspended its bug bounty program that paid up to $100,000 per flaw<\/a>. The company did not officially confirm AI-generated reports as the reason for the move, but experts suspect this is the case.<\/p>\n

You may like<\/p>\n

<\/p>\n

\n

\"Google\n<\/p>\n

<\/a><\/p>\n

Follow Tom’s Hardware on Google News<\/a>, or add us as a preferred source<\/a>, to get our latest news, analysis, & reviews in your feeds.<\/p>\n

Get Tom’s Hardware’s best news and in-depth reviews, straight to your inbox.<\/p>\n","protected":false},"excerpt":{"rendered":"Google has officially suspended product vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP) \u2014…\n","protected":false},"author":2,"featured_media":920364,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[62,276,277,49,48,61],"class_list":["post-920363","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-ca","tag-canada","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/920363","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/comments?post=920363"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/920363\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media\/920364"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media?parent=920363"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/categories?post=920363"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/tags?post=920363"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}