Google suspends open source bug bounty after AI spam surge

Google’s decision to halt part of its open source bug bounty because of AI-generated “slop” is a concrete example of AI eating its own security ecosystem. Cheap, automated vulnerability reports sounded like a win for defenders, but in practice they flooded maintainers with hallucinated bugs and low-quality findings. That not only burns scarce expert time, it also erodes trust in machine-generated security signals just as labs are trying to lean on AI for red-teaming and threat detection.

For the broader AGI race, this is a warning shot about naive automation. If even a focused bug bounty community can be overwhelmed, scaling agentic systems across critical infrastructure without careful throttling and validation is asking for similar overload failures. The incident highlights a growing asymmetry: models are getting better at generating plausible text faster than institutions can build filters, workflows and incentives that separate real risk from noise. Until that gap closes, organizations will respond by narrowing channels, as Google just did, or by raising the bar for what they will read at all.

Competitively, this nudges security-conscious developers toward curated channels and possibly toward vendors that bundle AI tools with strong human-in-the-loop triage. It also strengthens the case for specialized “AI-for-security” stacks that can distinguish substantive findings from synthetic junk, rather than treating generic LLMs as drop-in bug hunters.