AI Bug Bounty Spam: Google, Intel, curl Pull Back Rewards

What happened

Google has stopped accepting product vulnerability submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP). The company blamed a surge in automated reports, most of which turned out to be invalid. In a short post dated October 1, Google said the pause was driven by "a significant rise in automated submissions," and promised an update in the first quarter of 2027 4. The freeze does not cover OSS VRP supply chain reports or reports already in the queue. Google pointed researchers to its other reward programs and to its Patch Rewards Program instead 34.

Google is not the only one pulling back. Intel has also stepped back from paying researchers, though accounts differ on how far it went. One outlet says Intel removed financial rewards from its bug bounty setup earlier this fall 2. Another says Intel suspended a program that had paid up to $100,000 per flaw 3. Either way, a major chipmaker has stopped writing checks for vulnerability reports.

A pattern, not an incident

The Google decision is the most visible case so far, but smaller open-source projects hit the same problem first.

The curl project is the clearest earlier example. In July 2025, creator and lead maintainer Daniel Stenberg described AI-generated junk flooding the curl bounty program. By his count, about 20% of submissions were AI slop, and only 5% of 2025 submissions were genuine vulnerabilities 1. On January 26, 2026, he shut the program down 1. It had run since 2019 and paid more than $90,000 for 81 real bugs. Stenberg said the cost to curl's small security team could not be sustained 1.

The Linux kernel is under similar strain. Maintainers have said they are "completely overwhelmed" by CVE filings, and AI-assisted bug hunting has pushed the kernel toward a record of around 2,000 vulnerabilities per release 3. One report describes thousands of bogus automated CVE submissions 2. Linux also reportedly dropped support for some older network drivers after a wave of false AI-generated bug reports 3.

The Linux accounts do not fully agree on what is happening. One version is about fake findings 2. The other also points to a jump in counted vulnerabilities driven by AI tools combing the codebase 3. That gap matters, because it is the central tension in this story.

The same tools find real bugs

AI is not only producing noise. Security firm AISLE says its AI system found all 12 of the zero-day vulnerabilities OpenSSL recently disclosed 1. OpenSSL is one of the most heavily audited cryptographic libraries in existence. The same firm says it reported five genuine CVEs to curl while the curl team was dealing with the slop problem 1. AISLE calls the OpenSSL result the first real-world demonstration of AI-driven vulnerability discovery at that scale 1. That is a vendor describing its own work, so treat it with some caution. Still, a dozen zero-days in OpenSSL is not easy to wave away.

TechRadar summed up the tension: AI is speeding up vulnerability discovery, but it often produces flawed, incomplete, or hallucinated findings 4. Maintainers are not dealing with useless tools. They are dealing with tools whose output ranges from excellent to nonsense, and with submitters who often cannot tell which is which before they file.

Why it matters

Bug bounties work on a simple deal. Companies pay outside researchers to find flaws, and in return they get a manageable stream of credible reports. Generative AI has broken the second half of that deal. A report now costs almost nothing to produce, but a human maintainer still has to read, reproduce, and reject it. A financial reward encourages volume, and volume is exactly what AI makes cheap.

Taken together, these moves look like a structural problem rather than a run of bad months. Google's pause is the most notable piece of evidence. Google has deep pockets and large security teams, so if it found the volume unmanageable, it is hard to see how volunteer-run projects like curl can absorb it.

The likely outcome is not the end of bounties but a narrowing of who can easily take part. Possible changes include:

• requiring proof-of-concept exploits
• vetting or reputation systems for submitters
• restricting programs to invited researchers
• triaging submissions with AI before any human looks at them

Google's promised Q1 2027 update should show which direction a large vendor takes 4.

The risk is collateral damage. Pausing rewards cuts off independent researchers, and some of them are filing real flaws, including AI-assisted ones like the curl CVEs 1. Shutting down bounties reduces the slop, but it may also push real discoveries elsewhere: to private sales, to delayed disclosure, or nowhere at all. The industry's job now is to filter out the junk without losing those valid reports, and so far no one has shown how to do that.