Up Close
AI-made bug reports force Google to stop paying for open-source findings
Google paused its Open Source Software Vulnerability Rewards Program from 1 October after what it described as a significant rise in invalid AI-generated bug submissions, and it said it will update participants in the first quarter of 2027.
That pause matters beyond Google because a bug bounty is a paid channel for outside researchers to report security flaws, so one flood of low-value AI output has now shut a route that open-source maintainers and security researchers could use. This suggests a more concrete AI-safety problem than harmful text on its own: generative systems are creating enough plausible but useless security work to block a real operational control. It also points to a wider change for anyone deploying AI into security or reporting workflows: the question is no longer only whether a model can produce a finding, but whether the receiving system can filter, verify and budget for machine-made submissions without choking on them.