Google has paused its open-source software bug bounty program, and the reason is an unusual one worth knowing about if your business is evaluating any AI-powered security tool: the program was effectively swamped by a flood of AI-generated vulnerability reports that turned out to be mostly noise.
What actually happened
Google’s Open Source Software Vulnerability Rewards Program — which pays researchers for finding real security flaws in open-source projects — was paused effective 1 October 2026. The stated reason is a significant rise in automated, AI-generated submissions, many of which described vulnerabilities that didn’t actually exist. The volume of these low-quality, “hallucinated” reports reached a point where it was swamping the maintainers meant to review them, to the point that Google judged pausing the program preferable to continuing to process the flood.
Why this is a useful cautionary example, not just a tech-industry footnote
It’s easy to assume that “AI-powered” security tooling is automatically a net positive — more scanning, more coverage, more eyes on the problem, at a fraction of the cost of human analysts. This incident is a concrete, present-day example of the other side of that: when an AI system generates confident-sounding but false findings at scale, the result isn’t neutral, it’s actively harmful, because real humans still have to spend real time working out which reports are genuine and which are fabricated. A security process that was designed around a reasonable volume of serious, human-vetted submissions broke down when the volume of plausible-sounding noise outpaced the capacity to review it.
For a small business, the direct lesson isn’t about bug bounties — it’s about any vendor pitching an AI-powered security scanner, compliance checker, or monitoring tool. The pitch “AI finds more issues than a human could” is only valuable if those issues are real. An AI tool that generates a long list of “vulnerabilities” or “compliance gaps,” many of which turn out to be false positives, can cost your business more time than it saves, simply because someone still has to check each one.
What to ask before adopting an AI security tool
1. Ask the vendor directly what their false-positive rate looks like in practice, not just their detection rate — a tool that finds everything but also flags everything isn’t actually saving you time. 2. Ask whether findings are reviewed or validated before being surfaced to you, or whether you’re seeing raw, unfiltered AI output. 3. Start any new AI-powered security tool on a limited scope before trusting it broadly — this lets you judge the real signal-to-noise ratio on your own systems before it becomes something your team relies on daily.
If you’re weighing up an AI security tool a vendor has pitched you and want a second opinion on whether it’s actually pulling its weight, that’s exactly the kind of evaluation our cybersecurity team can help with.
Google’s own statement on pausing the program is covered in detail by TechCrunch.
More automated findings isn’t the same thing as more security — and this is one of the clearest real-world examples yet of exactly where that gap shows up.