Observed Signal · Oct 4, 2026 · Policy Update · Source: techcrunch · Impact: 4/5 · Sentiment: Negative
Google pauses open source bug bounty due to AI submissions
Google has paused its Open Source Software Vulnerability Rewards Program until the first quarter of 2027, citing a 'significant rise' in automated submissions, the vast majority of which are invalid. The pause took effect on October 1, 2026, and was announced on X and the program's website. Google engineers and open source maintainers were reportedly overwhelmed by reports containing hallucinations and invalid content. Participants are encouraged to consider other Google bug bounty programs in the meantime. This decision follows warnings from cybersecurity experts about AI-generated slop posing a serious risk to bug bounty programs.
Major platform Google pausing a security program due to AI-generated submissions highlights a growing industry-wide challenge of AI slop overwhelming review processes, impacting security research and potentially delaying vulnerability fixes in open source software.
Track Google Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Google paused its Open Source Software Vulnerability Rewards Program on October 1, 2026.
- The pause is attributed to a 'significant rise' in automated submissions, mostly invalid.
- The program is expected to resume or update in the first quarter of 2027.
- Google engineers and maintainers were overwhelmed by invalid or hallucinated reports.
- Participants are directed to other Google bug bounty programs during the pause.
Connected Companies & Entities
1 Entity mapped“Google paused its open source bug bounty program due to a significant rise in AI submissions....”
Ontology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Google Report: AI Doubles Software Vulnerability Disclosures
Google's Threat Intelligence Group reports that the number of disclosed software vulnerabilities has doubled within months, rising from 5,045 in January 2026 to 10,740 by August 2026. The report attributes this surge to the increasing use of AI agents in security research, which uncover different types of flaws than traditional scanners. Notably, 50% of AI-found vulnerabilities lead to remote code execution, compared to 26% for conventionally discovered ones. The report also highlights a rise in exploitation of known 'N-day' vulnerabilities, from 28 in all of 2025 to 75 between January and August 2026, likely accelerated by AI-assisted exploit creation. Additionally, vulnerabilities in AI infrastructure itself are growing, with over 1,500 reports in 2026, focusing on orchestration frameworks like Langflow and inference servers such as vLLM and Ollama. The report advises prioritizing patches based on threat intelligence and recommends AI-powered code reviews for software vendors.
OpenAI Launches Prompt-Injection Bug Bounty
OpenAI launched a new bug bounty program focused on prompt injection attacks—inputs that manipulate AI behavior to leak data, bypass controls, or execute unauthorized actions—and is offering rewards up to $7,500 for reproducible findings. The program explicitly calls out risks in agentic AI systems. The article's author describes defensive steps and an open-source tool they built, ClawMoat, which scans inbound user input and outbound model output for prompt injection, secret leakage, unsafe tool calls, MCP server misconfigurations and related risks. The post frames this as a watershed moment for AI security comparable to SQL injection for web apps and warns organizations to adopt input/output scanning, tool-call audits and logging ahead of regulatory deadlines such as the EU AI Act in August 2026.
Google says AI helped fix more Chrome bugs in June
Google reported that, with the help of internal AI tools and large language models, it patched 1,072 security bugs across the two Chrome releases in June (Chrome 149 and 150) — a total larger than the 1,036 fixes applied across the previous 23 releases over the prior two years. Google published a chart and white paper illustrating the exponential increase in discovered and fixed vulnerabilities after adopting AI-assisted techniques. The company’s Chrome engineering director said LLMs have transformed vulnerability discovery into an automated, industrial-scale operation. Microsoft similarly reported patching 570 security flaws this month and attributed the jump to its use of AI. Independent counts show Apple has patched 482 bugs in 2026 and does not appear to be seeing the same exponential increase. The article was published by TechCrunch on 2026-07-30.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.