Google has frozen its open source bug bounty program, pointing to what it called a significant rise in AI submissions. According to the report, AI-generated content appears to be overwhelming bug bounty programs more broadly.
Why it matters
Bug bounty programs rely on human-reviewed vulnerability reports, and a surge in AI-generated submissions can strain the capacity to triage and respond. Pausing the program signals that the volume of such submissions has become difficult to manage.
Who should care
Security researchers who participate in bug bounty programs, open source maintainers, and organizations running similar reward programs may be affected by this change and the trend it reflects.