Google praised AI for finding bugs. Now it has too many reports

AI made bug hunting easier. Now Google is dealing with the fallout. Google praised AI for finding bugs. Now it has too many reports, not enough bugs.

Now it has too many reports, not enough bugs AI made bug hunting easier. The company had already warned in March about a massive surge in AI-generated reports, including hallucinated bugs and low-impact issues. The timing is hard to ignore: Google has spent much of 2026 praising AI for making bug hunting faster, easier, and far more productive.

Google has been doing a pretty good job of showing off what AI can do for software security. Its AI agents are finding bugs humans missed, uncovering vulnerabilities buried in code for years, and scanning enormous codebases faster than security teams ever could. Google executives have even called some of these tools a “game changer.” But a rather funny wrinkle has emerged in that success story: AI has apparently become so good at helping people find bugs that Google has had to close one of the doors through which those bugs were being reported.

The search giant has temporarily stopped accepting product vulnerability submissions through its Open Source Software Vulnerability Reward Program, or OSS VRP, after what it describes as a “significant rise in automated submissions.” Google The change, first, took effect on October 1. Google says the “vast majority” of those automated submissions are not valid, and it will spend the next few months reworking this part of the program before providing another update in Q1 2027.