Google Pauses Open‑Source Bug Bounty Amid Surge of AI‑Generated Reports

Google announced on October 1 that its Open Source Software Vulnerability Rewards Program will remain on hold until the first quarter of 2027. The company cited a “significant rise in automated submissions, the vast majority of which are not valid,” noting that engineers and open‑source maintainers were inundated with reports containing hallucinations or outright fabrications.

Why it matters for GPU / AI infrastructure

The incident underscores a broader operational risk for organizations that run large‑scale AI workloads on GPU clusters. When AI‑generated content floods validation pipelines — whether bug bounties, model‑card reviews, or dataset curation — compute resources can be wasted on triage rather than productive training or inference.

• Automated triage tools must evolve to filter hallucinated findings before they reach human reviewers.
• GPU‑accelerated verification pipelines can reduce the cost of false‑positive handling.
• Clear submission guidelines and rate‑limits protect both maintainers and the integrity of reward programs.

Google plans to share an updated framework next year, and other platforms are watching closely to adapt their own bounty and audit processes.