Remember the Sorcerer's Apprentice, where Mickey enchants a broom to haul water and ends up drowning the workshop? Swap the broom for an LLM-powered bug-hunting script and the water for hallucinated vulnerability reports, and you've got Google's open-source security team this week.
The Inbox Won, For Now
On October 1, Google suspended product vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP), effective the same day, citing an influx of invalid AI-driven reports. Engineers and maintainers were reportedly buried under reports describing bugs that were invented outright or had negligible real-world impact.
It's not a total shutdown. Reports submitted before October 1 remain eligible, OSS VRP supply-chain reports are still accepted, and some product bugs in Google Cloud repos can still go through the Cloud VRP. Google says it will share an update by the first quarter of 2027 as it reworks the program.
When Finding Bugs Costs Nothing
Bug bounties have always relied on an unspoken bargain: finding a real vulnerability takes skill and time, so the reports that arrive are worth reading. LLMs nuked the "time" part of that equation. When generating a plausible-sounding report costs pennies, the economics flip, and the scarce resource becomes the maintainer reading it.
Google isn't alone. Curl previously ended its bug bounty over the same tide of AI slop, and Linux maintainers have described being overwhelmed as AI tooling drove a surge in reported kernel issues. The irony is thick: AI genuinely is getting good at finding real bugs, which means the signal is out there — it's just drowning in noise produced by people pointing the same tools at a payout button without checking the output.
The lesson for everyone, not just Google: AI that generates work without a human verifying it doesn't save time, it just moves the cost onto whoever's at the other end of the pipe.
If you're figuring out how to use AI in your own workflows without turning your team into the slop-sorting department, we'd be glad to help design the guardrails.
Source: Tom's Hardware via Yahoo Tech