Model hallucinations drown Google engineers, raising questions about the freeze of open-source bounty rewards

Google has closed the doors of its open-source vulnerability bounty program, announcing a freeze on submissions until early next year and pledging a comprehensive review in the first quarter of 2027. The emergency decision did not come because cyber risks have declined or because independent researchers lack interest in auditing; rather, it is a response to a sharp operational bottleneck that hit the company’s engineers and the supervisors of open-source projects, after they were inundated by a massive wave of automated reports generated by AI models without real efficacy.

Google confirmed on the program’s official site and in posts on X that the freeze, which took effect on 1 October, stems directly from a noticeable rise in automated submissions that show the overwhelming majority are invalid. Technical reports cited from Tom’s Hardware said the code-review teams found themselves swamped with false reports or ones stuffed with model hallucinations, where the tools craft security scenarios that appear coherent on the surface but collapse immediately when tested against the source code, proving no actual vulnerability exists.

Automated generation has turned into a flood of hallucinations that threatens the collapse of open-source security collaboration systems.This picture fulfills the warnings that cyber-security experts raised last year via TechCrunch, when they cautioned that the debris of generative content is now threatening the core of bounty programs that have historically relied on financial rewards for precise investigative human effort. Although Google directed participants toward other bounty programs tied to its commercial products, targeting open-source software specifically exposes the fragility of the collaborative architecture on which the global developer community depends, in the face of the adverse effects of unchecked automation.

In our follow-up of this case we see that Google’s crisis carries highly relevant operational lessons for cyber-security leaders, banks and digital authorities in the Gulf and Egypt, where governments and large corporations are expanding local vulnerability-bounty platforms to attract security talent. Continuing to accept submissions through traditional mechanisms has become a risk that drains security operations centres’ resources tracking fictitious flaws fabricated by algorithms of researchers seeking quick gains without scrutiny, which calls for a re-drafting of submission criteria in the region to require exploit models that are practical and actually implementable, while excluding any report that relies solely on synthetic wording.

Your practical step today in leading cyber-security teams is to re-engineer the initial review gates and update report-acceptance standards, shifting the focus from direct manual inspection to building strict digital filtering systems that isolate unverified automated reports early, thereby protecting engineers’ time and directing their resources toward safeguarding sensitive code assets instead of wasting effort dismantling generated hallucinations.