Google Halts Open‑Source Bug Bounty Program Amid Surge of AI‑Generated Invalid Reports
What Happened — Google announced an indefinite pause on new submissions to its Open‑Source Vulnerability Reward Program (VRP) because a “significant rise in automated submissions” produced mostly invalid reports. Existing submissions will still be processed, and other reporting channels (supply‑chain reports, Patch Rewards Program) remain open.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of third‑party contributions is a core control‑assurance requirement; unchecked AI‑generated noise can erode the evidentiary value of a bug‑bounty pipeline.
- Documented validation and triage processes provide a defensible audit trail that demonstrates due diligence to regulators and auditors.
- The pause highlights the need for automated pre‑screening combined with human review to prevent a denial‑of‑service‑style overload of security operations.
Who Is Affected — Open‑source projects maintained by Google, downstream software vendors, enterprises that embed those components, and security researchers who rely on the program for responsible disclosure.
Recommended Actions —
- Map your external vulnerability‑report handling to a control‑assurance program that requires continuous oversight and evidence collection.
- Deploy automated triage tools that flag low‑confidence AI‑generated reports, but retain human verification for final validation.
- Capture and retain documentation of vendor oversight activities (e.g., submission logs, validation decisions) to support audit readiness.
Source: DataBreachToday
Technical Notes — The surge consists of AI‑generated “slop” reports: hallucinated vulnerabilities, implausible patches, and repackaged findings that overload manual triage. Researchers describe the effect as a cognitive denial‑of‑service attack on bug‑bounty pipelines. No specific CVE is involved. Source: same as above