Google Pauses Open-Source Bug Bounty as AI-Generated "Slop" Reports Flood Review

On October 1, 2026, Google did something unprecedented in the history of bug bounties: it suspended the intake of product vulnerability submissions under its Open Source Software Vulnerability Rewards Program (OSS VRP). The official statement offered a single sentence of explanation, worded as cold as an eviction notice:

"This pause is due to a significant rise in automated submissions, the vast majority of which are not valid."

In plain language: too many auto-generated junk reports, most of them bogus, so we're closing the door. Computer Weekly security editor Alex Scroxton headlined his October 6 report "AI slop overwhelms Google's OSS bug bounty programme" — "slop" has now been stamped by a top-tier tech company's own actions as the security industry's keyword of 2026.

Worth noting: this is not Google going "anti-AI." The same statement encourages researchers to "find impact" across its other bounty programs. Nor is it shutting down its entire security response apparatus — just one precisely cut opening. This article dissects exactly that opening: why the "product vulnerability submission" link broke first, and what structural contradiction of the vibe coding era it exposes — one everyone has been avoiding.

What was switched off, and what wasn't

First, the facts, to keep the record straight. OSS VRP launched in August 2022 and covers Google-led open source projects — Go, Angular, Bazel, Protocol Buffers, Fuchsia — plus a selection of third-party repositories. Rewards range from $500 for security issues in projects Google classifies as Important (OT1) to more than $30,000 for supply-chain compromises in Flagship (OT0) projects.

What paused on October 1 is only the "product vulnerability" category — reports flagging code defects, logic flaws, or design bugs in public repositories. Three things are unaffected: first, OSS VRP supply-chain reports are still being accepted; second, reports filed before October 1 continue through the pipeline; third, Google's other bounty channels remain fully open, including the Cloud VRP and the Patch Rewards Program — which pays for fixing open source software, up to $15,000.

The narrowness of the cut is itself revealing. Google wasn't scared off by AI; it was doing precise cost accounting. Supply-chain reports (dependency poisoning, build-pipeline compromise) are still worth human review, because their validity and impact are comparatively easy to judge and enormously valuable when real. Code-level product vulnerability reports, by contrast, are exactly the category AI is best at mass-producing in convincing form — and the most expensive to triage. In other words, Google didn't switch off "AI." It switched off the submission category where triage cost had already exceeded report value.

This wasn't sudden: the "massive surge" started in March

The pause looks abrupt, but the fuse was lit six months ago. Back in March, Google publicly said OSS VRP was seeing a "massive surge" of AI-generated reports, including hallucinated vulnerabilities (things that don't exist in the code at all) and technically real but near-zero-security-impact coding errors dressed up to look like critical vulnerabilities.

Google's response at the time was to tighten evidence requirements: stronger reproduction evidence for certain vulnerability classes in its most important open-source projects, plus reduced or removed rewards for some lower-tier findings. It was a classic "raise the bar" move, designed to push part of the validation cost back onto submitters. The October pause is the admission that raising the bar couldn't hold back the flood — when submission cost approaches zero, any finite bar gets submerged.

There's a detail here worth savoring for indie developers: AI-generated vulnerability reports fail in two ways. The first is pure hallucination — the described flaw isn't in the code, and the reviewer burns half an hour reproducing nothing. The second is sneakier: real but meaningless findings — a genuine minor defect with no exploitability, written up as a polished, jargon-perfect "critical vulnerability report." The second kind is actually more expensive to triage, because a reviewer can't dismiss it at a glance; it takes a full threat-model and exploitability analysis to classify. Google's "vast majority are not valid" almost certainly covers both.

The data picture: a year when vulnerability discovery doubled

Google's Threat Intelligence Group (GTIG) supplied the hard numbers in a September 2026 study. Monthly publicly disclosed vulnerabilities have doubled this year: from 5,045 in January to 10,740 in August. Vulnerabilities actively exploited in the wild rose from an average of 10.5 per month in 2025 to 18 per month this year — with zero-day exploitation growing more slowly; the fastest growth is in rapid weaponization of known flaws.

Even more thought-provoking is GTIG's quality analysis of AI-assisted discovery: among AI-surfaced flaws, the share of low-risk findings is falling, moderate-risk findings are rising, and more of them can lead to remote code execution (RCE) — precisely the outcome ransomware gangs want most. In other words, AI isn't just producing more garbage; it's simultaneously producing more of the real stuff. Defenders face a double squeeze: noise drowning the triage channel, while the signal itself gets stronger and more dangerous.

GTIG also warns that public data likely significantly undercounts AI's true involvement, for two structural reasons: first, public CVE repositories still lack uniform metadata tags for AI attribution, so many AI-discovered flaws are statistically invisible; second, cloud and SaaS vendors often remediate AI-surfaced flaws directly in production without requesting CVE identifiers at all — CVEs are mostly reserved for on-prem software and third-party components that need coordinated end-user patching. The researchers' conclusion is blunt: vulnerability discovery and exploitation will keep growing in the short to medium term, and organizations must shift from unprioritized mass-patching to threat-intelligence-driven triage, with automated, agentic remediation at the front.

Over at the Linux kernel, the same thing is happening

Google is not alone. On May 17, 2026, Linus Torvalds wrote in his Linux 7.1-rc4 release post that the kernel's private security mailing list had become "almost entirely unmanageable" under AI-generated reports. His description was specific: different people running the same AI tools against the same code, finding the same flaws, filing them independently; because the channel is private, submitters can't see each other's reports, so maintainers spend their days forwarding duplicates or replying "that was fixed a week/month ago, see the public thread."

Torvalds called it "entirely pointless churn" and laid down a rule: bugs found with AI tools are by definition not secret and shouldn't go through the private security channel; if you want to add value, read the documentation and attach a tested patch — put real value on top of what the AI did. The kernel community has since formalized an AI Coding Assistants policy requiring AI-assisted contributions to be tagged.

Put Google and the Linux kernel side by side and the picture is complete: this is the same shock hitting the entire open-source security collaboration system in 2026. The kernel's version is arguably worse in one respect — Torvalds wasn't even describing slop. Many of the reports were real bugs; the duplication alone was enough to break the process. Which shows the root cause isn't report quality but a structural imbalance between submission volume and triage capacity: AI has driven the marginal cost of discovery to near zero while the marginal cost of validation hasn't budged.

The core contradiction: generation is cheap, verification is expensive

This is the central argument I want this piece to stand on: AI has driven the cost of "finding vulnerabilities" to near zero, but dumped the entire cost of "validating reports" onto human reviewers. It is the hardest evidence yet, from the security domain, of the vibe coding era's structural contradiction — generation is cheap, verification is expensive.

A bug bounty program is essentially a two-sided market, and its design rests on an implicit assumption: the submitter's effort (the time and skill to dig up a vulnerability) naturally exceeds the reviewer's effort (reading the report, reproducing it). When that assumption holds, the system is self-consistent — submitters self-filter and only file what they're confident about, because filing junk wastes their own time. AI shattered the assumption: generating a polished, jargon-perfect vulnerability report now costs pennies, while validating it still takes a security engineer tens of minutes to hours. The self-filtering mechanism is gone, and the triage channel has become a free public dumping ground.

And this isn't a security-only story — security is just where it broke first. The same script is playing out everywhere: open-source PR queues flooded with AI-generated "improvements," recruiters drowning in AI-polished résumés, academic conferences receiving AI mass-produced papers. Every "generation is cheap, verification is expensive" scenario ends at the same step — gatekeepers forced to close the door, raise the bar, or push validation costs back onto submitters. Google chose "close for renovation"; the Linux kernel chose "rules plus tagging." More platforms will follow, in different forms.

There's a deeper read, too: this pause is actually proof of AI security tools' genuine power, not their failure. If AI-generated reports were all hallucinations, Google could filter them with automated rules and would never need to suspend a whole category. What's really breaking Google is the report stream mixing in enough "looks real, needs careful human review to disprove" material — which is exactly the current generation of AI security agents' true level: strong enough to overwhelm human triage, too weak to self-validate. Stuck in that middle state — that is 2026.

For indie developers: the bounty-hunting rules are being rewritten

Time to spell out what this means most directly for VibeFix readers. I know plenty of indie developers are running AI-powered security scans and bounty hunting — "AI vulnerability mining" sounds like a low-bar, high-return side hustle. Google's pause is the official notice that this road's rules are being rewritten.

The conclusion first: the crude "AI-scan-everything, batch-submit-reports" model is dead. Not because AI is useless, but because everyone is using the same methods, producing the same reports, aimed at the same triage queue. When submission becomes zero-cost labor, bounty programs will defend themselves in three ways — and each one raises your ticket price:

First, evidence requirements will only get heavier. Google already demanded "stronger reproduction evidence" in March; the redesign will almost certainly make a reproducible PoC a hard gate. Future bounties won't reward "what you found" but "what you proved" — a complete reproducible chain, affected versions, exploit conditions, all required. AI can generate hypotheses for you, but the manual work of verification and reproduction can't be skipped.

Second, "submit a patch" is replacing "submit a report." Note the alternative channel Google specifically named in its pause statement: the Patch Rewards Program, which rewards fixing, not finding — up to $15,000, still open. Torvalds's demand was the same: attach a tested patch. The signal is clear: people who only "point at problems" are being devalued; people who "fix the problem and prove it's fixed" are being revalued. If you have AI-assisted development skills, consider pivoting from "bounty hunting" to "high-quality fixes" — the competition there is an order of magnitude thinner.

Third, reputation and rate limits will become standard. Expect the redesigned OSS VRP in Q1 2027 to include submitter reputation systems, submission rate limits, and automated pre-screening. The first to be locked out will be anonymous batch submitters with no track record of valid reports. Start building a record of valid submissions now — even on small projects — it's worth more than hoarding a hundred unsent AI reports.

One last piece of advice for every vibe coder running AI security scans: never submit unverified AI output directly to an external reviewer. This isn't just ethics; it's strategy. Every invalid submission burns your own reputation budget, and reputation is precisely the scarcest currency after the redesign. Use AI as a magnifying glass, not a money printer — let it help you understand code and generate hypotheses, then reproduce by hand, write the PoC by hand, and craft the patch by hand. Slower, but it's the only road still open.

What happens in Q1 2027

Google has committed to publishing a redesigned program in the first quarter of 2027. Details are unknown, but its March moves and the industry discussion sketch the likely shape: stricter reproducible-evidence standards, automated pre-screening (fighting AI with AI — let machines filter a round first), submitter reputation and rate-limit mechanisms, and a clearer boundary between product-vulnerability and supply-chain reports.

My prediction: the redesigned OSS VRP will become an elitist small pool — far fewer submissions, but higher average report quality and richer bounties per report. Google isn't short of vulnerabilities — GTIG's data makes clear there will only be more; it's short of trustworthy validation bandwidth. Whoever can deliver "self-validated" reports will earn outsized returns in the new pool.

Zooming out: 2026 will be remembered as the year "AI slop" officially became an infrastructure problem. From the Linux kernel's mailing list to Google's bounty program, human collaboration systems are being forced to redesign their rules for "generation oversupply" for the first time. Vibe coding gave everyone the superpower of generation, and the events of late 2026 remind us of the other half of the truth — when generation becomes free, verification becomes the only scarce resource. Whoever controls verification controls the pricing power. That holds for the security industry, for the content industry, and for indie developers like us, alike.