Google benches open source bug bounty program following ‘significant rise’ in AI submissions (www.techradar.com)

Google has announced a pause on submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) due to a significant influx of invalid reports generated by AI. The surge of AI-driven, flawed, or irrelevant submissions has rendered the process unmanageable, prompting the company to reassess its approach. This pause is set to last until the end of the year, during which Google aims to refine the program and mitigate the overwhelming effects of automated submissions. The rise of generative AI tools has indeed revolutionized fault detection, with models like Mythos and GPT-5.6-Cyber enabling companies to discover vulnerabilities at an unprecedented rate. However, the reliability of these AI systems remains questionable, as demonstrated by a study from 1Password's Off-by-1 Labs, which found nearly half of the patches produced by AI either failed to address existing vulnerabilities or worsened security. This situation is not unique to Google; other projects like curl have also struggled with similar issues, leading to the cessation of their bug bounty programs. As the AI/ML community navigates these challenges, it highlights the need for improved context and human oversight in vulnerability discovery to ensure meaningful contributions to cybersecurity.