It’s a Tuesday morning. You’re on the triage rotation for a bug bounty queue, coffee in hand, and the inbox has more reports in it than it had all of last month. The first one looks fine. Clean writeup, plausible code path, confident language, a severity rating already filled in. You spend forty minutes tracing it and find the function it describes doesn’t exist. The second one is the same shape. So is the third. By lunch you’ve burned half a day confirming that nothing happened.
That’s the scenario Google just blinked at. On October 1, 2026, the company announced via an official X post that it was suspending product vulnerability submissions to its Open Source Software Vulnerability Reward Program, pointing to an overwhelming influx of invalid AI-generated reports. Participants were encouraged to look at other VRP programs in the meantime. Google says it’s reformatting this part of the program and will have an update by the first quarter of 2027, with a stated commitment to a more sustainable model for handling AI-assisted security research.
I review AI tools for a living, and this is the most honest thing anyone in big tech has said about agents all year. Not in the press release language, which is diplomatic. In the act itself. Google looked at a program it launched in 2022 to protect the open source ecosystem, and decided that running it was currently worse than not running it.
The economics were always going to break
Bug bounties work because of an asymmetry. Finding a real vulnerability is expensive, so submitting a report costs the researcher real time. Reading a report is comparatively cheap. The payout at the end filters for quality, because nobody wants to spend three days on a writeup that earns nothing.
Agents invert that. Generating a confident, well-structured, correctly formatted vulnerability report now costs close to nothing. Verifying one costs exactly what it always did, because verification requires a human who understands the codebase. The filter didn’t get weaker. It got removed, and the cost stayed on the side that was never built to absorb it.
This is the part the agent-hype crowd keeps skipping. When you make production free and leave verification expensive, you haven’t automated the work. You’ve moved the work onto someone who isn’t getting paid for it and didn’t ask for it.
Why the reports are so convincing
The failure mode here is specific and worth understanding if you’re evaluating any security agent. Language models are extremely good at the form of a vulnerability report. The structure is formulaic: summary, affected component, reproduction steps, impact, suggested fix. A model can produce that shape perfectly while being wrong about every fact inside it.
Worse, the wrongness is sophisticated. These aren’t reports that say “the login is bad.” They cite plausible function names, describe realistic attack chains, and reference real CVE classes. A triager can’t dismiss them on sight. They have to be checked. That’s the whole problem in one sentence.
What this means if you ship an AI security tool
Some blunt advice for the vendors in this space, because a lot of you are about to have a bad quarter.
- Precision is the only metric that matters now. Recall is cheap and nobody is impressed. If your tool surfaces fifty findings and six are real, you are a liability, not a product.
- Proof-of-concept or bust. A report that doesn’t come with a working reproduction is a hypothesis. Tools that can actually execute against the target and demonstrate impact are in a different category than tools that read code and speculate.
- Stop optimizing for submission volume. If your marketing brags about how many reports users filed, you are selling a spam cannon with a nice dashboard.
- Verification belongs inside your loop. If the human downstream is your validation layer, you built a demo and shipped it as infrastructure.
The maintainers were the ones paying
Google can suspend a program. It has staff, a legal team, and the luxury of taking a quarter or two to redesign something. Open source maintainers don’t. A lot of them are one or two people with day jobs, and the reason OSS VRP existed at all was to put resources behind projects that hold up a frightening amount of the internet.
So the thing that got damaged here isn’t Google’s reputation. It’s the already thin trust between volunteer maintainers and the security researchers who report to them. Every fake report makes the next real one slightly less likely to get a careful read.
Google’s suspension isn’t a defeat for AI in security. Code analysis is genuinely one of the better fits for these models, and some of that work is real. But the current crop of tools is being pointed at human attention as if it were infinite, and that assumption just got tested at scale by one of the largest programs in the industry. The program broke first. That’s useful information, and I’d rather have it now than after the maintainers burned out.
🕒 Published: