📰 Key Takeaways

Google has paused its Open Source Software Vulnerability Rewards Program, citing a “significant increase” in automated submissions, the vast majority of which are invalid reports. The pause officially took effect October 1, with Google posting about it on X and on the program’s official site, and promising to share an update in Q1 2027.

According to Tom’s Hardware, Google’s engineers and open source maintainers have recently been swamped with invalid reports or ones generated from AI hallucinations, dramatically increasing the review burden. Google’s official statement said: “This pause is due to a significant rise in automated submissions, the vast majority of which are not valid vulnerability reports.” This echoes warnings from cybersecurity experts cited in a TechCrunch report last year — that “AI slop” content was becoming a serious threat to bug bounty programs, risking review resources getting buried under a flood of low-quality or fabricated submissions.

During the pause, Google is advising researchers to use its other bug bounty programs to keep submitting reports and earning rewards. As for when the Open Source Vulnerability Rewards Program itself will resume and what adjustments will follow, that won’t be announced until Q1 2027.

💬 JudyAI Lab Take

Google pausing its Open Source Software Vulnerability Rewards Program comes down to a surge in automated submissions, most of them invalid — a sign that AI-generated content is starting to backfire on review systems that were built on human trust.

The lesson here for AI builders: once the cost of producing content approaches zero, the burden on whoever has to review it downstream gets amplified without limit. This isn’t just a bug bounty problem — any system that relies on human gatekeeping (code review, support tickets, academic submissions) could face the same flood of “AI slop.” The fact that Google chose to pause the entire program rather than filter case by case suggests that, right now, the cost of detecting AI-hallucinated content may actually be higher than the cost of just shutting the program down. It’s a reminder that when you design any open submission system, upfront quality gates matter just as much as downstream review resilience.

If you’re building anything that lets other people submit content or reports, now’s the time to ask yourself: when submission volume gets amplified 10x by AI tools and most of it is low quality, can your review process actually hold up?

📅 Source Info

🔗 Further Reading