<strong>Hustler Words – Google has officially hit the pause button on its Open Source Software Vulnerability Rewards Program, citing a massive influx of low-quality, AI-generated submissions. The decision, which took effect on October 1, marks a significant shift in how the tech giant manages its community-driven security efforts, as the company struggles to separate genuine security threats from "AI slop."
The disruption comes as a direct consequence of what engineers are describing as an overwhelming wave of automated reports. According to reports from Tom’s Hardware, Google’s security teams and open-source maintainers have been inundated with submissions that are either entirely invalid or plagued by "hallucinations"—a common phenomenon where AI models confidently present false information as fact.
In a statement released via X and the program’s official portal, Google clarified that the surge in automated, non-valid entries has made the current system unsustainable. "This pause is due to a significant rise in automated submissions, the vast majority of which are not valid," the company explained.
Related Post
This development validates previous warnings from cybersecurity experts, who have long cautioned that the democratization of AI tools could lead to a flood of "garbage" data, potentially crippling traditional bug bounty ecosystems. Instead of helping secure the web, bad actors or low-effort users are leveraging large language models to spam programs with nonsensical vulnerabilities, wasting the precious time of human experts.
While the open-source program remains suspended, Google has not provided an immediate timeline for its revival, only promising a formal update in the first quarter of 2027. In the interim, the company is directing security researchers to focus their efforts on its other active bug bounty initiatives, which remain unaffected by this AI-driven bottleneck.
Leave a Comment