AI bug reports are outrunning the people fixing them
Bounty programs are tightening access while maintainers struggle to separate useful reports from extra work.
The dots
- curl: Its bounty paid for 87 confirmed vulnerabilities before closing January 31. Maintainer Daniel Stenberg blames a flood of AI-generated junk reports.
- GitHub: Its revised public bounty pays $10,000 for a Critical bug. GitHub cites low-effort and AI-generated submissions; higher Critical rewards sit in an invite-only tier.
- Google: Google paused its open-source bounty on October 1; it expects an update in Q1 2027. Source: TechCrunch.
- Maintainers: Seven companies committed $12.5 million through the Linux Foundation to help open-source projects handle and fix security findings.
Our take
Sending a report is getting cheaper. Checking it still lands on somebody's desk. A longer queue is a miserable prize for the person maintaining the software.
The funding problem is real too: Node.js paused rewards after losing external bounty funding. Calling every pause an AI-spam problem misses that distinction.
We think that by March 31, 2027, Google will publish revised open-source bounty rules requiring a working reproduction or merged patch for more than half its product-vulnerability payout tiers. That is our prediction, not an announced policy.
Watch
Google's published rules on March 31, 2027. No revised rules by then, or proof required for half the tiers or fewer, means our call missed.