Google has temporarily halted its open source bug bounty program, effective October 1, 2026. The company stated that the pause is due to a "significant rise in automated submissions, the vast majority of which are not valid."
Reports suggest that Google engineers and open source maintainers were overwhelmed by invalid or hallucinated reports. The program previously rewarded researchers for identifying vulnerabilities in Google's open source software.
Google has indicated it will provide an update on the program in the first quarter of 2027. Participants are encouraged to consider Google's other bug bounty programs in the interim.