Google paused its open-source bug bounty program after a flood of low-quality, AI-generated reports overwhelmed its security teams, according to TechCrunch. The AI age has a spam problem.
What a Bug Bounty Is
A bug bounty programme is a system where companies invite independent security researchers to find and responsibly report vulnerabilities in their software, websites and services. In return, researchers can receive recognition and, in many cases, a financial reward. The reward is based on the severity and impact of the issue they discovered.
When it works well, everyone benefits. The company learns about weaknesses before criminals can exploit them. Researchers are paid for careful and ethical work. Ordinary users end up with safer products.
Programmes like this depend on trust, clear rules, and detailed, reproducible reports that an internal security team can verify quickly.
How AI Spam Breaks It
That system breaks down when it is flooded with low-quality reports generated with the help of AI. Tools can now produce long, confident-sounding vulnerability reports in seconds, even when no real vulnerability exists.
Some submissions copy generic descriptions, invent impact, or point to behaviour that is actually intended. For a security team, every single report still has to be read, triaged and checked, because a genuine critical flaw could be hidden in the pile.
Spam therefore does not just waste time. It slows down responses to real findings, raises costs, and can frustrate the reviewers whose judgement keeps the programme running.
Why Pausing Makes Sense
Pausing the programme in those circumstances is a sensible, if disappointing, step. A temporary freeze gives the team space to clear a backlog, tighten submission requirements, improve automated filtering, and add checks that separate thoughtful research from mass-produced noise, without lowering standards for valid reports.
Message for Real Researchers
For real researchers, the message is important rather than discouraging: quality matters more than ever.
A strong report should show exactly what was found, how to reproduce it step by step, what the realistic impact is, and clear evidence to support the claim. Researchers who do that careful work remain valuable. A cleaner programme should ultimately mean their genuine findings are reviewed faster, and taken more seriously.
Watch the video: Google FROZE Its Bug Bounty Because of AI Spam! #Shorts on YouTube. This article is the full written version of the video, in simple English. See all articles on the Blogs page and more videos on the Science & Tech page.