Untitled Post

Google’s OSS Vulnerability Reward Program didn’t get hacked. It got buried in paperwork. On October 1, Google suspended product vulnerability submissions entirely—not because the bugs ran out, but because maintainers were drowning in AI-hallucinated reports that looked just credible enough to demand a human review before being discarded. The curl project killed its bounty outright. Linux networking maintainers are pushing real fixes to the next kernel cycle because the queue is clogged with AI-generated noise. Intel’s bounty went dark too. This isn’t a few programs having a bad quarter. This is the same failure mode hitting every program that opened its doors to the public and assumed good-faith participation would self-select.

Bug bounties worked because finding a real, exploitable vulnerability was genuinely hard. That friction filtered out low-effort submissions organically. LLMs didn’t lower the skill floor—they eliminated it. Anyone with a GitHub repo URL and a prompt can now generate a plausible-sounding report in seconds. The incentive structure never accounted for this. Programs pay on valid findings; they don’t charge for invalid ones. The cost of submitting garbage is zero. The cost of reviewing it falls entirely on the maintainer.

This is an asymmetry problem with teeth.

Google’s suspension reveals the shape of it clearly. Supply chain reports still count; product vulnerability reports don’t. Google is essentially triaging by submission type because it can no longer triage by submitter quality. The company has resources that most open-source projects don’t. If Google can’t make the economics work, nobody can. The curl project’s decision to end its bounty entirely is the clearest case—Daniel Stenberg has been public about the time cost. That’s not a big-vendor problem with infinite engineering resources. That’s one maintainer making a hard call about where to spend hours.

Real work stops while you’re sorting the noise.

The Linux networking maintainers didn’t announce their decision with a press release. They just started pushing legitimate fixes to the next kernel cycle instead of handling them in the current one. That’s a concrete, measurable security lag caused entirely by submission volume. The Internet Bug Bounty program—administered by HackerOne, over $1.5 million paid out since 2012—has paused payouts because AI-assisted discovery is flooding submissions faster than open-source maintainers can remediate them. Node.js lost bounty funding as a direct result. The researchers who do this work carefully and legitimately are now competing with bots for maintainer attention, and losing.

What happens when you add more friction to a market that’s already breaking? You don’t fix the market. You break it worse, usually in ways that hurt the people you meant to help.

Google says it will “reformat” the program. That almost certainly means some combination of proof-of-concept requirements, pre-screening automation, or reputation gating. Each of those adds friction back—but artificially, and in ways that will disadvantage legitimate researchers in unfamiliar ecosystems more than they disadvantage bad actors with automated pipelines. A researcher discovering their first real vulnerability in a project they use will face higher barriers. A service running hundreds of LLM instances against target repositories will adapt its prompts and resubmit. The signal-to-noise ratio doesn’t improve. It just shifts the burden from maintainers to newcomers.

The deeper problem is structural. Bug bounties were designed as a market: pay for value, get more value. AI submissions are market spam. You can’t fix spam by redesigning the product catalog. You fix it by changing who can submit and how they’re accountable. There’s no obvious solution that doesn’t either close the program to newcomers—killing the discovery diversity that made bounties valuable in the first place—or require a level of submission verification infrastructure that most open-source projects can’t afford to run.

Google has until Q1 2027 to figure this out, which sounds like a long runway until you consider that the same AI tooling causing the problem will be considerably more capable by then, and considerably more accessible. The programs that survive this are probably going to look less like open bounties and more like credentialed research relationships—closer to how enterprise vendors have always handled coordinated disclosure with known researchers. That might produce higher-quality findings. It will almost certainly produce fewer of them, from a narrower slice of the global security community. Whether that tradeoff is acceptable is a question nobody in the industry seems ready to answer directly yet.