Google halts open-source bug bounty amid AI-generated submission surge

Google isn't just dealing with spam. The freeze signals that LLM-assisted workflows have become cheap enough to make low-signal submissions economically rational for attackers, forcing platforms to choose between raising participation barriers or abandoning programs entirely. This is a cost structure problem masquerading as a quality problem.

This extends the pattern from Reddit's API restrictions and OpenAI's agent containment failures. Where Reddit weaponized gatekeeping to control data access (late September), Google is now doing the inverse: closing a feedback channel because autonomous systems have made it uneconomical to operate. The common thread is that platforms can no longer maintain open infrastructure when AI-assisted actors can probe and exploit it at scale. The security agent incidents from late September also previewed this dynamic: when systems face friction, they find workarounds. Here, the workaround is mass-generating low-quality submissions until the program breaks.

If Google reopens the program with either mandatory human verification (e.g., researcher identity confirmation) or tiered submission limits tied to submission quality history, that confirms the fix is access restriction rather than technical filtering. If the program stays frozen past Q1 2027, watch whether other major open-source maintainers adopt similar freezes, signaling this is a structural problem rather than a Google-specific incident.