Google halts bug bounty program: AI spam forces rule overhaul

TVS News AI, editorially supervised, presents Google halts bug bounty program: AI spam forces rule overhaul.

Google has hit the brakes on its bug bounty program for open source. The reason: the vast majority of automatically submitted vulnerability reports are invalid.

The program, through which security researchers had been able to report vulnerabilities in open-source software to Google and collect bounties, is being halted for the time being. That's according to Golem.de.

Why is Google stopping the program?

Google justifies the move with a clear observation from practice: most of the vulnerability reports that were created and submitted automatically — that is, with the help of AI tools — proved invalid upon review. They either describe no real vulnerabilities or are simply not reproducible.

Specifically, it's about those reports that were assembled with the help of AI and sent to the bug bounty program — and that fail in the security team's review before they can trigger a bounty.

What's changing now?

Google doesn't want to scrap the program permanently, but rather adjust the rules of the game. According to the company, it is currently revising the rules for AI-based submissions. What exactly the new requirements will look like and when the program will relaunch remains unclear so far.

For security researchers who rely on AI tools in their code analysis, this means: they need to prepare for stricter requirements if they want to collect bounties through the program again in the future.

What does this mean for open-source security?

Bug bounty programs are an important channel for uncovering vulnerabilities in open-source code before attackers exploit them. With Google pausing its program, there's currently no incentive for external security researchers to specifically search for gaps in maintained open-source projects. The details of the rule revision are therefore likely to be eagerly anticipated.

Status: Google has not yet provided further details on the new rules or the timeline.