Google has paused its open-source bug bounty program after a flood of invalid AI-generated submissions. The pause took effect on October 1, with new product vulnerability reports no longer accepted through the Open Source Software Vulnerability Rewards Program, or OSS VRP.

This pause is due to a significant rise in automated submissions, the vast majority of which are not valid, the company wrote in a post on X. Google said engineers and open source maintainers were overwhelmed by reports that were invalid or contained hallucinations.

The pause is narrower than a full shutdown. Reports filed before October 1 are still being processed, supply-chain reports continue to be accepted, and researchers are being directed to Google's other bounty programs. Google promised an update in the first quarter of 2027.

The problem had been building. In March 2026, Google tightened the program's rules once, requiring stronger evidence such as OSS-Fuzz reproductions for some reports. In January, the curl project ended its bug bounty after years of AI-generated reports.

The episode shows how AI has shifted the bottleneck in security research. Generating bug reports is now cheap, but verifying them still needs skilled humans, and every hallucinated report takes time from real vulnerabilities.