Google Freezes Its Open-Source Bug Bounty Over AI Submissions

Google has frozen its open-source bug bounty programme, citing a significant rise in submissions generated by AI, TechCrunch reported.

A bounty programme runs on an assumption that no longer holds: that writing a vulnerability report costs the submitter real effort, so the volume stays within what a review team can read. A model can now produce a plausible, well-formatted report describing a flaw that is not there, at effectively zero cost. Every one of those still has to be read by a person before it can be dismissed.

The economics invert

The defence a bounty programme has against noise is the submitter's time. Remove that and the programme becomes a channel for transferring review cost from anyone with an API key to the maintainers. For open source in particular, where review often falls on unpaid volunteers, the arithmetic stops working before the programme is formally overwhelmed.

Freezing is a blunt answer, and it has a cost of its own: the real reports stop arriving too.

What it means for a small engineering team

Any Ethiopian software firm running a disclosure inbox faces the same arithmetic on a smaller budget. If Google's review capacity can be swamped, a five-person team's certainly can. The practical response is triage that filters on reproducibility — a working proof of concept, not a well-written description — before a human reads anything.

Open

TechCrunch did not report how long the freeze will last, what share of recent submissions were AI-generated, or whether Google intends to restart with different intake rules.

Sources: TechCrunch, 4 October 2026