2026-10-04 / Signal #6

Google paused the open-source bug bounty because AI invented the bugs

“The bug bounty didn’t run out of money. It ran out of humans who could prove the bugs weren’t imaginary.”

The Story

Google stopped accepting new *product* vulnerability reports to OSS VRP as of Oct 1 after a surge of automated, mostly invalid AI submissions. Supply-chain reports and already-filed cases continue. The company promised a redesign update in Q1 2027. Maintainers describe thousands of confident, unexploitable “hallucinated” reports crowding out real bugs. Linux CVE volume and Intel’s bounty pause are the rhyme.

Why It Matters

Institutions choking on synthetic labor. Same family as arXiv’s two-paper cap, but a new artifact: Google turned off a bounty because the hunters are now infinite and wrong. Builder-facing, slightly funny, not doomer.

Evidence

Google VRP on X (Oct 1); Tom’s Hardware (Oct 3); Techmeme

Sources

Daily scan: 2026-10-04

tomshardware.comhttps://www.tomshardware.com/tech-industry/artificial-intelligence/google-suspends-part-of-the-oss-vrp-bug-bounty-program-due-to-an-influx-of-invalid-ai-submissions-product-vulnerability-submissions-ended-october-1