Google Freezes Bug Bounty Program as AI Submissions Overwhelm Reviewers

What happened

Why it matters

• ·Organizations that rely on Google's open source vulnerability program for security intelligence now face a gap of at least one quarter. Security teams should identify which open source components in their stack depend on that program for disclosed vulnerability data and find alternative monitoring sources in the interim.
• ·Any enterprise running its own vulnerability disclosure or bug bounty program faces the same throughput risk. AI tools lower the cost of generating high-volume, superficially credible reports, and reviewer capacity does not scale to match. Governance teams should assess whether intake controls can distinguish AI-generated submissions from genuine ones before reviewer queues collapse.
• ·This incident exposes a broader control gap: many compliance and risk intake processes, not just security programs, assume a manageable volume of human-authored submissions. Where AI tools can generate submissions at low cost, organizations need filtering and triage controls at the intake layer, not just human review downstream.

Governance controls affected

What to do now

• ☐Identify which open source software components in your environment relied on Google's Open Source Software Vulnerability Rewards Program for vulnerability disclosures, and assign an alternative monitoring source for each until the program reopens.
• ☐If your organization runs a vulnerability disclosure or bug bounty program, ask your security team whether the intake process has any controls to flag or filter AI-generated submissions, and set a threshold at which volume triggers a review of reviewer capacity.
• ☐Audit any high-volume external intake process, including compliance reports, whistleblower submissions, or vendor security questionnaires, to assess whether the process could be overwhelmed if AI tools are used to generate submissions at scale.
• ☐Ask your third-party risk team whether contracts with open source security intelligence providers include provisions for program suspensions, and confirm that alternative data sources are identified for each dependency.
• ☐Review your AI output quality controls to confirm that any AI-assisted process your organization operates for generating external submissions, such as automated vulnerability scanning reports sent to vendors, includes a human review step before submission.

What to watch next

Compliance teams should monitor whether Google publishes new submission criteria or AI-content filters when reopening the program in 2027. These are likely to become an industry reference standard for managing AI-generated intake volume. The incident may also prompt vulnerability disclosure platforms and bug bounty operators more broadly to publish guidance or policy changes. Regulators focused on software supply chain security, particularly under frameworks like the EU Cyber Resilience Act, may reference this episode. Their focus will likely include how organizations manage third-party security reporting channels. Organizations should also watch whether the suspension triggers any changes to open source security disclosure timelines for vulnerabilities already in the pipeline.