Google Suspends Open Source Bug Bounty Program Due to AI-Generated Spam Reports

Thumbnail Image

The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.

Google has temporarily suspended its Open Source Software Vulnerability Reward Program after being overwhelmed by a flood of AI-generated, low-quality, and often false vulnerability reports. This operational disruption has strained security teams, delayed genuine issue handling, and affected the broader open source security ecosystem. Similar challenges are impacting other tech companies.[AI generated]

Why's our monitor labelling this an incident or hazard?

The article explicitly states that AI-generated reports with false or low-impact information have overwhelmed Google's vulnerability reward program, leading to its partial suspension. This is a direct consequence of AI system use (AI-generated reports) causing operational disruption and harm to the security ecosystem. The harm includes disruption of critical infrastructure management (security vulnerability handling) and harm to the community of security researchers and maintainers. The event meets the criteria for an AI Incident because the AI system's use has directly led to significant harm and disruption. It is not merely a potential risk or a complementary update but a realized harm caused by AI-generated content flooding the system.[AI generated]
AI principles
SafetyRobustness & digital security
Industries
Digital security
Affected stakeholders
BusinessWorkers
Harm types
Economic/PropertyReputational
Business function:
ICT management and information security
AI system task:
Content generation

Articles about this incident or hazard