Google stopped paying for some bug reports. AI wrote too many fake ones.

On 1 October 2026, Google announced it was suspending part of its Open Source Software Vulnerability Rewards Program — the scheme that pays outside researchers for finding security flaws in Google's open source code.

The stated reason was short. The pause is "due to a significant rise in automated submissions, the vast majority of which are not valid."

The suspension is narrower than most headlines have suggested. SecurityWeek reports that it applies only to reports about flaws in the products themselves. Reports concerning the supply chain are still being accepted, and submissions made before 1 October are still being processed. Google pointed researchers to two programmes it continues to run — one covering its cloud repositories, and a separate scheme that pays for proactive security improvements rather than for finding faults.

Google says it will reformat the programme and provide an update in the first quarter of 2027.

In Simple Terms

A bug bounty is a standing offer. A company says: if you find a security hole in our software, tell us privately rather than exploiting it or selling it, and we will pay you for it.

It works because the incentives line up. The company gets more people looking at its code than it could ever employ. The finder gets paid. The flaw gets fixed before someone malicious finds the same thing.

Google has now partly withdrawn that offer for its open source projects, because too much of what arrives is fiction — reports that describe security flaws which do not exist. The programme had run since 2022, so roughly four years. (Derived from the dates.)

The Money

Google has not published what this programme paid out or how many researchers it paid, so the direct financial scale of the pause is not public.

What can be measured is the cost that caused it, and that cost does not sit with Google's accountants. It sits with whoever reads the reports.

Every submission has to be assessed by a person who understands the code. That person must read the claim, reason about whether it could be true, and attempt to reproduce it. An invalid report consumes nearly as much of that time as a valid one, because you only discover it was invalid by doing the work.

The economics underneath this are what broke. Producing a plausible-looking vulnerability report used to require understanding the vulnerability — and that effort acted as a filter. With AI writing tools, producing one requires a prompt. The cost of submitting collapsed toward zero. The cost of checking did not move. And the people absorbing the checking cost were never the ones being paid.

Follow the Money

Who this reaches. Beyond the announcement itself, this is Rainingmoney's reading.

Open source maintainers are the clearest losers, and most were losing before this. Many maintain critical software unpaid, as a side commitment. The flood of invalid reports is unpaid work arriving at a volunteer's inbox with the appearance of urgency attached.

Legitimate researchers lose a paid channel and, worse, lose the benefit of the doubt. Their genuine findings now sit in a queue behind twenty fabrications and are read by someone exhausted.

Newcomers are the quiet casualties. The cheapest defence available to any programme is to prioritise hunters with an established track record. That is sensible and it disadvantages anyone who does not yet have one.

Google saves triage capacity at a reputational cost, having partly withdrawn from a programme it launched as a commitment to open source security.

Attackers are the group nobody intends to help. A flaw that goes unreported because the reporting channel closed, or unnoticed because it was buried in noise, stays open. Whether this has already happened is not something anyone can currently measure.

Everyone else, including every Nigerian bank app and payment platform built on open source components, depends on this system working and has no visibility into it at all.

The Bigger Picture

This is not a Google story. It is the fourth major retreat in roughly six months.

HackerOne, which operates bug bounty programmes for many large companies, paused new submissions to the Internet Bug Bounty — a shared fund for widely used open source projects — on 27 March. Node.js, which runs a substantial share of the world's web applications, paused its programme afterwards. And curl, a small utility embedded in an enormous number of devices and services, removed its cash rewards after maintainer Daniel Stenberg reported that only a tiny fraction of submissions were legitimate.

Industry voices quoted by Dark Reading treat this as a correction rather than a crisis. Ensar Seker of SOCRadar called the HackerOne pause "a rational, even overdue correction." David Hayes of FusionAuth said the model as currently structured is not sustainable. Trey Ford of Bugcrowd located the fault in the design: the industry, he argued, spent years optimising the wrong end of the pipeline — competing to attract more hunters without building the capacity to verify what they sent.

The curl episode is the most instructive part of the year, because it accidentally ran an experiment. curl reopened without cash rewards, and by April Stenberg reported the flood had eased and genuine findings had climbed back above 15%. Remove the money and the volume collapses — which suggests much of it was never security research but a cheap attempt at a payout. (That inference is Rainingmoney's; Stenberg reported the result, not the motive.)

It leaves every programme with an unattractive choice. Pay, and invite the flood. Don't pay, and exclude everyone who cannot afford to work for recognition alone.

The Jargon

Bug bounty — a standing offer of payment for privately reporting a security flaw.

Vulnerability — a weakness in software that could let someone do something they should not be able to do.

Open source — software whose code is public and free to use, often maintained by volunteers. Most commercial software, including banking apps, is built on top of it.

Hallucination — when an AI system produces something fluent and confident that is simply untrue. The core problem here: the reports read like competent security work and describe flaws that do not exist.

Triage — the work of sorting incoming reports to establish which are real and which matter. This is the bottleneck.

Supply chain (in software) — the chain of outside code, libraries and tools a piece of software depends on. Still in scope for Google's programme.

Zero-day — a flaw not yet known to the people who could fix it, and therefore undefended.

What Happens Next

Known. The pause took effect 1 October 2026 and covers product vulnerability reports. Supply chain reports and earlier submissions are unaffected. Google has committed to reformatting the programme and updating in Q1 2027. Its cloud and patch-reward programmes remain open.

Possible. Reputation-gating, where only researchers with a track record can submit, is the cheapest available fix and the one to watch for. More programmes may pause. Some may return without cash, as curl did. Automated verification — tooling that reproduces a claimed bug before a human reads the report — is the fix that would actually resolve this, and nothing announced so far suggests anyone has built it at scale.

Unknown. What Google paid out historically, and how many researchers relied on it. What proportion of submissions were invalid, in Google's own numbers — it gave a characterisation, not a figure. Whether any real vulnerability has already been missed because of the noise. And what the reopened programme will actually look like.

Rainingmoney's Take

Analysis, not reporting.

The framing to resist is that AI has made software less secure by finding too many problems. It hasn't. It has made the act of claiming to have found a problem almost free, while leaving the act of checking exactly as expensive as it was. Every bounty programme was built on an assumption nobody wrote down — that writing a credible report was hard enough to serve as a filter. That assumption is gone, and the structures resting on it are falling over in sequence.

For Rainingmoney's readers there are two things worth holding.

The first is practical. If you earn, or hoped to earn, from this work, the paid channels are thinning and the survivors will likely want proof of who you are before they read what you found. Building a verifiable track record now, including through unpaid programmes, is worth more than it was a year ago. That is an unwelcome answer, and it is the honest one.

The second is structural, and it should bother anyone building on open source — which in Nigerian fintech means essentially everyone. The security of the free software underneath our banking and payment infrastructure has always depended on goodwill that nobody adequately funded. The bug bounty was a partial, imperfect patch over that gap. Watching it buckle under automated noise is a reminder of how thin the arrangement always was.

Google will likely be fine. The question worth returning to in the first quarter of 2027 is what happens to the maintainers who do not have Google's options, and to the researchers who were just getting started.