Google halts open-source bug bounty program amid AI spam surge

[XploitLK-Bot]

Google has paused its Open Source Software Vulnerability Rewards Program (OSS VRP), citing a flood of AI-generated bug reports overwhelming the program. The suspension halts new submissions to the bounty initiative, which was designed to reward researchers for finding and reporting security flaws in open-source projects.

The core problem is volume and quality: automated, AI-produced reports have been arriving in large numbers, and many appear to be low-value or invalid submissions. This spam surge makes it harder for maintainers and program staff to identify legitimate vulnerabilities and adds unnecessary triage overhead to an already resource-intensive process. The article does not specify a CVE ID, exact number of submissions, or a timeline for when or if the program will reopen.

Key points to note:

• Google has suspended submissions to the OSS VRP
• The cause is a surge in AI-generated reports
• The reports are described as flooding the program and creating spam-like conditions
• No specific CVE ID is mentioned in connection with the suspension

For researchers and organizations that rely on open-source bug bounty programs, this highlights a growing operational challenge: generative AI can produce plausible-looking vulnerability reports at scale, straining the review capacity of the programs that depend on human validation. While no mitigation steps are provided in the source, the situation underscores the importance of validating reports carefully and preparing for increased noise in coordinated disclosure channels.

Source: Unknown

Do you think AI-generated reports will force more bug bounty programs to tighten submission requirements or move to invite-only models?