Google has stopped paying for bug reports in its open source software, and it says machines are the reason.
The company’s Open Source Software Vulnerability Rewards Program stopped accepting product vulnerability reports on 1 October. Google’s notice says the pause is due to a significant rise in automated submissions, the vast majority of which are not valid.
Google did not say how many reports it received or what share were rejected. Tom’s Hardware reported that the company’s engineers and outside open source maintainers had been overwhelmed by reports that were wrong or contained hallucinations.
The problem is familiar to anyone running a bounty. A language model can produce a report that reads as competent, with an exploit path that does not exist or a vulnerable function that cannot actually be reached. Each one still has to be read by a person before it can be dismissed. Money makes it worse. A bounty pays per valid finding and costs nothing to enter, so the rational move for a submitter with an AI tool is volume.
Google has promised an update in the first quarter of 2027. In the meantime it is pointing researchers to its other reward programmes, and some reports touching Google Cloud repositories may still be accepted through the cloud scheme.
The timing is awkward. The freeze took effect a day after Google released Gemini 4 Argon, its most powerful model, to cyber defenders before anyone else.
Both things can be true: AI can find real flaws and invent fake ones. What Google has not explained is how a reopened programme would tell the two kinds of report apart, or whether the answer is simply another model doing the reading.
