Google’s Bug-Bounty Programme Is Overwhelmed by AI-Generated Reports

Google’s effort to find software vulnerabilities is facing an unexpected problem: artificial intelligence is generating security reports faster than human security teams can process them.

Google recently paused new submissions to its open-source software bug-bounty programme after receiving a surge of vulnerability reports, many of which were generated with the help of AI. The programme rewards researchers who identify genuine security flaws, but the growing use of AI tools has also made it easier to produce large numbers of automated reports, including submissions that may not represent meaningful vulnerabilities.

The development highlights a new challenge in cybersecurity. Bug-bounty programmes depend on researchers providing accurate information that allows companies to investigate and fix security weaknesses. When automated systems produce large volumes of questionable reports, security teams can spend valuable time separating genuine threats from false or low-quality submissions.

The issue also illustrates an emerging tension in the AI race. The same technology being promoted as a tool for improving productivity can create additional work when used without sufficient verification.

For Google, the problem is not simply the number of reports. It is whether existing security processes can keep pace with a technology capable of generating them at scale.

As AI becomes more deeply integrated into cybersecurity research, companies may need to rethink how vulnerability programmes evaluate submissions, reward researchers and distinguish meaningful discoveries from machine-generated noise.