Artificial intelligence is overwhelming one of Google's security programs. The company has stopped taking product vulnerability reports for its Open Source Software Vulnerability Reward Program, citing a "significant rise" in AI-generated submissions, TechCrunch and The Verge reported. Most of those reports were invalid.

The pause took effect on Oct. 1, according to Help Net Security and Tom's Hardware. Reports about software supply-chain risks, and reports filed before Oct. 1, are not affected. Google said it plans to update the program in the first quarter of 2027.

Bug bounty programs pay outside researchers who find security flaws so that companies can fix them before criminals exploit them. Google has run such programs for more than a decade and has paid out millions of dollars.

The problem is volume. AI tools make it easy to generate reports that look technical but describe flaws that do not exist. Some of these reports include made-up code or imaginary errors. Each one still has to be checked by a person, which pulls staff away from real threats. Open-source volunteers who maintain the affected projects have also complained about the extra work.

Other projects have faced the same flood. The maintainers of curl, a widely used data-transfer tool, have publicly complained about AI-generated bug reports in recent years.

Here is why it matters. Open-source software is the hidden foundation of the internet. It runs in phones, cars, banks and government systems. When maintainers are swamped, real bugs can slip through.

The move is a sign of a bigger challenge. AI can help security experts find real flaws faster, but it can also bury them in noise.

What we know: Google paused product bug reports to its open-source bounty program as of Oct. 1.
What we don't: What changes Google will make before reopening in 2027.