Google has suspended its open-source bug bounty program, with the pause set to last until 2027, according to reports from inc.com, Malwarebytes and the Digital Watch Observatory. The company attributed the decision to a rise in submissions that were invalid, a shift linked to the growing use of AI tools to generate reports.
The program had paid researchers for finding and reporting security flaws in open-source software. According to inc.com, the pause points to a weakness in relying on AI for this kind of work: automated tools can produce large volumes of submissions that do not hold up on review, adding to the workload of the teams that triage them.
Malwarebytes reported that the increase in AI-generated submissions prompted the suspension, while the Digital Watch Observatory said the program would remain on hold until 2027. The reports did not specify how many submissions were affected or which projects were involved.
The episode highlights a broader tension for bug bounty programs, which depend on a steady flow of accurate, verifiable reports. When submissions are produced at scale without the underlying research to support them, the review process absorbs the cost. Google's move suggests the company sees a need to reassess how it handles that volume before reopening the program.
What to watch next: whether Google restores the program in 2027 as stated, and whether other companies running similar bounty schemes adjust their submission rules in response to AI-generated reports.
