Kind Hacker's Job Taken Over, Their Replacement is Incompetent

Google has temporarily halted the acceptance of vulnerability reports from one of its bug bounty programmes. This decision was made following a massive influx of invalid reports generated by automated artificial intelligence (AI) systems.

Google stated that the Open Source Software Vulnerability Rewards Program (OSS VRP) has received so many false and irrelevant reports that they have become difficult to manage. Consequently, Google has decided to suspend all report submissions until the end of 202int26.

Google will utilise this hiatus to re-evaluate the reporting process and seek solutions to ensure the programme can operate more effectively.

“For the time being, we are no longer accepting vulnerability reports for the OSS VRP products. This does not affect OSS VRP supply chain reports or reports currently in progress. As an alternative, we encourage you to look for impacts in our other VRP programmes and submit them there, or follow the Patch Rewards Program,” Google stated in a post, as reported by TechRadar.

Google explained that the decision was driven by a significant surge in automated reports, most of which were found to be invalid.

“Why is this happening? This pause is caused by a significant increase in automated reports, most of which are invalid. We will continue to restructure and work on aspects of the OSS VRP and are committed to providing an update in Q1 2027,” Google said.

This phenomenon highlights the downside of using AI in security vulnerability hunting. While AI technology is capable of helping researchers find large numbers of vulnerabilities much faster, AI-generated reports produced without human analysis and oversight can result in erroneous findings, lack strong evidence, or even involve ‘hallucinations’.

Research from 1Password Off-by-1 Labs in August, which tested the ability of AI to find and fix security flaws, showed that 49.3% of patches failed to close at least one existing exploitation path. Furthermore, 20.1% of patches fixed the initial problem but altered application behaviour, while 2.3% introduced new security issues, and 2.2% failed to fix the vulnerability while simultaneously creating additional exploitation paths.

1Password concluded that a lack of context remains the primary challenge; when AI is provided with more complete background information, the results are significantly better.

Google is not the first company to face issues due to a flood of AI-based security reports. In January 2026, the developers of curl also suspended their bug bounty programme on HackerOne after facing numerous false issue and vulnerability reports.

Months later, Linus Torvalds also complained about the flood of security reports created using AI, stating that the situation has made the Linux security mailing list almost entirely unmanageable.

“The continuous stream of AI reports has essentially made the security mailing list almost entirely unmanageable, with massive duplication because different people are finding the same things using the same tools,” said Torvalds.

According to him, much time is ultimately wasted simply forwarding reports to the correct parties or explaining that issues had already been resolved previously.