Google Paused Cash for Bug Hunts Because of AI Spam
Google has paused its program that pays people for finding security bugs in its free, open-source software. The pause started October 1, and Google said it will give an update in early 2027. TechCrunch
The program paid independent researchers who spotted flaws. Google told researchers with work in progress to look at its other bug bounty programs.
Google said the reason was a sharp rise in automated reports, and almost all of them were invalid. Google described it as a volume problem in the review queue.
The pause does not cover everything. Reports about flaws in products are stopped. Reports about the supply chain, which cover information about outside code parts and how problems spread, are still open. Times of India Google linked the freeze to invalid reports made with AI. Tom's Hardware
The two types of reports need different work. A product report needs a person to rebuild the software, repeat the bug, and judge how serious it is. A supply-chain report looks at lists of code parts and where they are used.
Google has changed these rewards before. It published rules in 2023 for reporting bugs in AI products, to help researchers test AI safety and security. Google Security Blog In the first year, that AI program received more than 150 reports and paid more than $55,000. Google Security Blog In 2026 it started rewards for fixes to OSV-SCALIBR, its free tool for finding weak spots in code parts. Google Security Blog
Taken together, that record shows a simple pattern. Google opens new reward areas and closes queues that stop working.
The broader context here is easy to picture. AI has made it cheap to write a report that looks real. Checking it still takes a person a lot of time.
In my view, this is less a step back from open-source safety than a sign the payment model breaks when bad reports are cheap. Paying for each good find works when finds are hard to make. It fails when weak reports cost almost nothing to create but take real work to reject.
Looking at what this means for researchers, the short-term message is plain. Sending in lots of weak reports does not just go unpaid. It can close the program itself. Careful work with clear steps to repeat the bug will still matter.
Worth flagging is the line Google drew. It kept the reports that computers can help check and paused the ones that need more human judgment. That saves reviewer time now and points to clearer forms and automatic checks first. That quiet fix is how free software stays safer for all of us.
