Google's Bug Bounty Program Faces Issues Due to AI-Generated Reports
Google has temporarily stopped accepting certain reports for its bug bounty program, citing a significant increase in automated and invalid submissions generated by AI.
Google paused a category of submissions for its Open Source Software Vulnerability Reward Program (VRP) on October 1. The program is designed to pay external researchers for identifying security flaws in software.
The company cited "a significant rise in automated submissions, the vast majority of which are not valid" as the reason for the pause. This has made it difficult for Google to distinguish genuine security vulnerabilities from fabricated or AI-generated reports.
Google is not the first entity to encounter this issue. Earlier this year, the open-source project curl discontinued its own bug bounty program. Submission rates for confirmed vulnerabilities reportedly fell below 5 percent starting in 2025, down from over 15 percent in earlier years.
While fueled by artificial intelligence (AI), this problem is rooted in older psychological and biological principles, such as the "handicap principle." Previously, the effort required to produce a submission acted as a filter, but AI has largely removed this barrier. The consequences extend beyond bug reporting, impacting the broader perception and reliability of signals.