Google has temporarily suspended the submission of vulnerability reports for its open-source software reward program. This restriction will remain in effect until at least the first quarter of 2027. The decision follows a surge in low-quality reports generated by artificial intelligence, which forced engineers to spend excessive time vetting thousands of non-existent or impractical security flaws.
Automated tools have flooded projects such as Go, Angular, Fuchsia, and related GitHub Actions with these reports. Despite the pause, Google continues to process submissions for Google Cloud repositories. Furthermore, the company maintains its Google Patch Rewards program, where researchers can still earn up to $15,000 for verified fixes.
The issue extends beyond Google, as other major projects face similar challenges. The curl developer previously shut down its program on HackerOne due to automated submissions, while Linux kernel maintainers reported thousands of fictitious CVE entries. These incidents highlight the growing burden on teams tasked with distinguishing genuine threats from AI-generated noise.
