Why Did Google Freeze Its Open-Source Bug Bounty?

A surge of plausible but inaccurate AI-written vulnerability reports overwhelmed human reviewers, forcing Google to pause paid submissions.

Google paused its open-source bug-bounty program after a steep increase in AI-generated vulnerability submissions swamped human reviewers. The problem is not that AI can never find a bug; it is that a tool can cheaply produce thousands of reports that sound technical while being incomplete, duplicated, or wrong. That creates a denial-of-service problem for the people who must reproduce each claim and find the real flaws hidden in the pile.

For everyday users and developers, the rule is simple: treat an AI-written security warning as a lead, not proof. Confirm the affected version, reproduce the behavior in a safe test environment, and check the project’s official advisory before patching or panicking. For open-source users, expect slower triage until maintainers find better filters for the noise.