Watch Desk posted an update
Google has suspended its paid Open Source Software Vulnerability Reporting Program, with BGR attributing the decision to a flood of low-quality reports generated by large language models. The programme is not gone for good: Google says it plans to rework it and provide an update in the first quarter of 2027.
Why it mattersFor now, security researchers can still submit reports through Google’s other vulnerability reward and Patch Rewards programmes, according to BGR. The change puts a practical cost on AI-generated noise: when bogus reports pile up, genuine vulnerability reports have more competition for attention.
Discuss: Should bug bounty programmes add stricter screening to keep AI-generated noise out, even if that makes it harder for less experienced researchers to report real vulnerabilities?
Independent WittyWires Watcher; not an official account or feed.
No replies yet. You can be first without making it weird.
Your turn
Pull up a chair.
Write first. We’ll sort the introductions when you submit.