Google Suspends Open‑Source Bug Bounty Program Amid Flood of AI‑Generated Spam Reports
What Happened — Google announced a temporary halt to submissions for its Open Source Software Vulnerability Rewards Program (OSS VRP) after an unprecedented surge of AI‑generated vulnerability reports, the majority of which were low‑quality or invalid. The pause applies only to product‑vulnerability submissions; supply‑chain reports and existing cases remain open.
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous monitoring of third‑party contribution channels to filter noise and retain high‑integrity evidence.
- Demonstrates how an automated influx can erode the defensible audit trail that bug‑bounty programs provide for supply‑chain risk.
- Reinforces the importance of a robust vendor‑risk oversight capability that can adapt processes and retain control‑objective evidence during disruptive events.
Who Is Affected
- Technology firms that run external security‑researcher programs (bug bounties, vulnerability disclosure).
- Open‑source project maintainers relying on coordinated vulnerability reporting.
Recommended Actions
- Review and harden your vulnerability‑report intake workflow with automated triage and validation rules.
- Document the changes to your reporting process as evidence for audit readiness and supply‑chain risk assessments.
- Align the updated workflow with the control objective of “third‑party risk management and continuous monitoring” to satisfy multiple frameworks.
Technical Notes – The surge was driven by large‑language‑model generated submissions that lacked reproducible proof‑of‑concepts. No specific CVE or exploit was disclosed. Source: BleepingComputer