A bug bounty program needs people to report security flaws. Too many reports, especially ones that do not hold up, can turn that useful signal into a queue of work. Google has paused its open-source vulnerability rewards program after a rise in automated submissions, most of which it says were invalid.
A pause, not a shutdown
Google paused its Open Source Software Vulnerability Rewards Program on October 1. The program rewards researchers who find vulnerabilities in Google’s open-source software.
The company said it would provide an update in the first quarter of 2027. Until then, participants are encouraged to consider Google’s other bug bounty programs.
Google described the reason as a “significant rise” in automated submissions, adding that the vast majority were not valid. The reports have also been linked to AI-generated submissions, including claims containing hallucinations. The result, as described in reports about the pause, was added pressure on Google engineers and open-source maintainers to review material that did not identify real vulnerabilities.
When volume stops being useful
Bug bounty programs depend on a basic exchange: researchers send in credible findings, and companies reward reports that help them fix security problems. Automation can increase the number of submissions, but more entries do not necessarily mean more useful discoveries. Someone still has to check them.
That distinction matters for security teams. A report that is merely wrong takes time to assess. A fabricated or hallucinated finding can also make it harder to spot the reports that deserve attention. Google’s statement does not provide figures for the volume of submissions or explain how it will assess them before the program resumes.
For now, the practical message to researchers is simple: the open-source program is on hold, and other Google bounty programs remain an option. The company has set a date for its next update, not a confirmed date for the program’s return. In security research, as in inbox management, a larger pile is not the same thing as progress.