AI Slop Bug Reports: How a Flood Broke a Bug Bounty

Writing a security bug report used to take a skilled person a day. Now it takes a model eleven seconds, and checking one still takes a human engineer about an hour. That ratio is why AI slop bug reports shut down one of the most important security programmes in open-source software. On October 1, 2026, Google paused its Open Source Software Vulnerability Rewards Program, telling participants that “this pause is due to a significant rise in automated submissions, the vast majority of which are not valid.” The programme is suspended until Q1 2027. Nothing was hacked. The intake queue simply stopped working.

Key Takeaways

• Google paused its Open Source Software Vulnerability Rewards Program on October 1, 2026, blaming a surge in automated submissions that were mostly invalid. It promised an update in the first quarter of 2027.
• The failure is economic, not technical. Generating a plausible-looking vulnerability report costs seconds; verifying one costs a maintainer between thirty minutes and two hours of focused attention.
• This is not new, just newly severe. Daniel Stenberg of curl documented the pattern in January 2024: 415 reports received, with 66% being neither security issues nor ordinary bugs.
• Models produce confident wrong reports partly because of how they are scored. OpenAI’s own research concluded that “standard training and evaluation procedures reward guessing over acknowledging uncertainty.”
• The transferable lesson for a kid is a rule about systems: when making a request costs almost nothing and answering one costs a lot, whoever has to answer eventually stops answering.

What actually happened to the bug bounty

A bug bounty is a programme in which an organisation pays outsiders for reporting security flaws, so that people who find problems have a reason to disclose them rather than sell or exploit them. Google’s open-source version covered vulnerabilities in the open-source software Google maintains and depends on.

TechCrunch reported on October 4, 2026 that the programme was paused as of October 1. Google’s stated reason was short: a significant rise in automated submissions, the vast majority not valid. Participants were pointed toward the company’s other bug bounty programmes in the meantime.

To understand why that is a big deal, follow a report through the system.

Someone submits a claim: “this library has a buffer overflow in this function.” A triage engineer reads it. Then they try to reproduce it, which means building the software, constructing the input described, and watching what happens. If it reproduces, it escalates to the maintainers of that code, who diagnose and fix it, and the reporter gets paid. If it does not reproduce, the engineer has to decide whether the report is wrong or whether they set it up wrong, which usually means trying again a different way.

That last step is where the damage happens. A report that is obviously nonsense gets closed in two minutes. A report that is wrong but internally coherent, with plausible function names and a confident explanation, can consume an afternoon.

Why AI slop bug reports cost more than ordinary spam

Daniel Stenberg maintains curl, a piece of software that runs in roughly everything with a network connection. In a post on January 2, 2024, he laid out the numbers from curl’s bounty programme: 415 vulnerability reports received, of which 66% were neither security issues nor normal bugs.

His description of the mechanism is the best sentence written on this subject: “The better the crap, the longer time and the more energy we have to spend on the report until we close it.”

That inverts the usual intuition about low-quality submissions. Spam is cheap to ignore because it is obviously spam. A fluent, well-formatted, entirely fabricated vulnerability report is expensive to ignore, because the only way to know it is fabricated is to do the work of checking.

Stenberg documented two concrete cases. One reporter submitted a false claim about a known CVE, mixing details from unrelated security issues, and said openly they had used an AI assistant. A second, filed in late December 2023, claimed a WebSocket buffer overflow and even proposed a fix. It looked legitimate. Repeated investigation found no overflow existed.

Two years later, the same pattern took down a Google programme.

The general rule: production cost versus evaluation cost

Here is the idea worth keeping, because it applies far beyond security research. Any intake system has a hidden ratio: the cost to produce a submission divided by the cost to evaluate one. When that ratio is near 1, the system is stable. When it collapses toward zero, the system fails, and it fails by shutting the door rather than by getting better at sorting.

System	Cost to produce one submission	Cost to evaluate one	What happened when the ratio collapsed
Email, 1995	A few minutes to write	Seconds to read	Spam filters became mandatory infrastructure
Open-source bug bounty, 2026	Seconds, with a model	30 minutes to 2 hours of engineer time	Google paused intake entirely
Volunteer maintainer inbox	Seconds	Unpaid attention from one or two people	Maintainers burn out and projects go unmaintained
Scientific peer review	Months of research, historically	Hours of a reviewer’s unpaid time	Journals report rising volumes of low-quality submissions
Your kid’s homework	Seconds, with a chatbot	A teacher reading 120 essays	Assignment design changes, or grading stops meaning anything

That last row is not a joke, and it is the reason this story belongs in a parenting publication. The bug bounty is the clean laboratory version of the thing happening in your child’s school, and it has the advantage of an unambiguous outcome: the programme closed.

Why models write confident reports about bugs that do not exist

This is a design consequence, not a mystery. OpenAI published research in September 2025 arguing that language models hallucinate because “standard training and evaluation procedures reward guessing over acknowledging uncertainty.” Their analogy is a multiple-choice test: “If you do not know the answer but take a wild guess, you might get lucky and be right. Leaving it blank guarantees a zero.” Under that scoring, a system that always answers beats a system that sometimes abstains, so the trained behaviour is to answer.

Detection research exists but is partial. Farquhar, Kossen, Kuhn and Gal published a method in Nature in June 2024 that uses “semantic entropy” to flag arbitrary and incorrect outputs by measuring uncertainty at the level of meaning rather than wording. The authors are careful about its limits, noting it “does not guarantee factuality because it does not help when LLM outputs are systematically bad.”

The security industry has formalised the risk. The OWASP Top 10 for LLM Applications 2025 lists Misinformation as LLM09, describing it as “a core vulnerability for applications relying” on model output. A fabricated vulnerability report is LLM09 with a stamped envelope.

For the broader mechanics of why a model can be fluent and wrong at the same time, our explainer on hallucinations and bias covers the underlying behaviour.

How to Teach Your Kid About AI Slop Bug Reports

The concept is asymmetric cost. You do not need code to teach it.

Ages 5–8: the paper airplane race

You get a stack of paper and a two-minute timer. Your job is to make as many paper airplanes as you can. Their job is to test each one by throwing it and writing down whether it flew more than two metres. Start together. Within ninety seconds they will be buried, and they will say so out loud, which is the whole lesson. Then ask: “What if I could make a hundred planes a second?” Let them answer. Most kids land on “then I would just stop testing,” which is precisely what Google did.

Ages 9–12: run a triage queue

Make twelve index cards about a Scratch project or a game they know. Three of them describe real problems you have actually seen. Nine are invented but plausible, written in confident language with specific-sounding details. Shuffle and hand them over with a timer running. Have them sort into “real,” “not real,” and “cannot tell without checking.”

The useful part is the third pile. Count how long the average card in that pile took. Then compute: if someone sent one card every ten seconds for an hour, how many cards would be waiting? Three hundred and sixty. Ask what they would do.

Ages 13+: write the issue template

Real projects defend themselves with structure. Have your teen find an open-source project on GitHub and read its bug-report template, then write one for a project of their own, even a small one. The requirement to list exact version numbers, a minimal reproduction, and observed versus expected behaviour is not bureaucracy. It is a cost shifted back onto the reporter, deliberately.

An extension worth doing: have them calculate the arithmetic Google faced. At 45 minutes of triage per ambiguous report and one engineer working six focused hours a day, how many reports per day can that engineer close? Eight. Now ask how many a model can write in six hours.

The question to ask: “If sending a report costs nothing and checking one costs an hour, who ends up deciding which bugs get fixed?”

The answer most kids reach after a minute is the right one: nobody decides, because the people who were deciding stop reading.

What to do about this at home and at school

Separate “I found a problem” from “a model told me there is a problem”

If your kid reports a bug, a security issue, or a factual error that a chatbot surfaced, the rule is: you may pass it on only with evidence you produced yourself. A screenshot, a reproduction, a line number. This is a small discipline that will matter enormously in their working life, and it is the exact discipline Google’s queue was missing.

Teach the volunteer-time ethic explicitly

Most open-source software your family depends on is maintained by a handful of unpaid people. Sending them an unverified machine-written report is not neutral; it spends their attention. Kids understand this instantly when framed as “this is one person in Sweden, and you just took an hour of his evening.” That framing is also literally true in curl’s case.

Ask the school what its grading ratio is

Not confrontationally. The useful question at a parent evening is: “Given that a student can now produce a polished essay in thirty seconds, what has changed about how you evaluate work?” Teachers who have an answer usually have a good one, involving in-class writing, oral defence, or process artefacts. Teachers who do not have an answer are facing the same collapsed ratio Google faced, with less ability to pause intake.

Model the behaviour with your own work

If you use an assistant for anything with stakes, say the verification step out loud in front of your kid. “It told me this, so I checked it here, and it was wrong about the date.” Three repetitions of that sentence do more than any lecture about AI literacy. Our guide to teaching kids to evaluate AI output has a fuller routine.

What not to do

Do not tell kids that AI-assisted security research is inherently illegitimate. It is not. Automated vulnerability discovery is a real and valuable field, and some of the best findings of the last two years came from machine-assisted analysis. The distinction is verification, not authorship. A report whose claim has been reproduced is a good report regardless of what wrote the prose.

What to Watch For Over the Next 3 Months

• Week 4: Watch whether other bounty platforms add friction rather than pausing. Deposit requirements, reputation gates and mandatory proof-of-concept attachments are all ways of raising production cost back toward evaluation cost. Which one wins tells you how the industry solves this.
• Month 2 red flags: Watch for the same collapse in a system your family touches: a school help desk that stops answering email, a forum that closes new-member posting, a game’s report button that quietly stops doing anything. The symptom is always a door closing, not a queue growing.
• Month 3 self-check: Google promised an update in Q1 2027. When it arrives, read what changed in the intake rules, not the announcement language. If the fix is “we now require a working reproduction,” that is a direct admission of the ratio problem and a template everyone else will copy.

Frequently Asked Questions

Did Google’s bug bounty get hacked?

No. Nothing was compromised. The programme stopped accepting reports because the volume of invalid automated submissions made triage impractical. It is a capacity failure, closer to a flooded call centre than to a breach.

Is AI bad at finding security bugs?

Not uniformly. Machine-assisted analysis has produced genuine findings, and automated fuzzing has been standard practice for years. The problem is the subset of output that is fluent, specific and wrong, combined with reporters who submit without verifying. Those are two different failures, and only the second one is new.

Why can’t they just use AI to filter the AI reports?

Partly they can, and platforms are trying. But a filter that is wrong in either direction is costly: reject a real vulnerability and you get a breach, accept noise and you are back where you started. OWASP lists misinformation as a core LLM risk precisely because using a fallible system to check a fallible system compounds rather than cancels the error.

Should I stop my teenager from doing security research?

No, and it is one of the better things a technically curious teenager can learn. Point them at projects with published disclosure policies, insist they reproduce anything before reporting it, and have them read curl’s documentation of bad reports first. Learning what a worthless report looks like is half the skill.

What does this have to do with homework?

Both are intake systems with a collapsed cost ratio. A teacher evaluating 120 essays and an engineer triaging 300 reports face the same arithmetic, and both respond by changing the assignment or closing the door. Knowing that is a better basis for a conversation with a school than a debate about cheating.

How do I explain this to a nine-year-old in one sentence?

“If it takes me one second to ask you a question and an hour for you to answer it, I can stop you from ever doing anything else.” Kids find that immediately, slightly alarmingly, obvious.

---

About the author

Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.

---

Sources

1. Ha, Anthony. (2026). “Google froze its open source bug bounty program due to a ‘significant rise’ in AI submissions.” TechCrunch, October 4, 2026. https://techcrunch.com/2026/10/04/google-froze-its-open-source-bug-bounty-program-due-to-a-significant-rise-in-ai-submissions/
2. Stenberg, Daniel. (2024). “The I in LLM stands for intelligence.” January 2, 2024. https://daniel.haxx.se/blog/2024/01/02/the-i-in-llm-stands-for-intelligence/
3. OpenAI. (2025). “Why language models hallucinate.” September 2025. https://openai.com/index/why-language-models-hallucinate/
4. Farquhar, S., Kossen, J., Kuhn, L., & Gal, Y. (2024). “Detecting hallucinations in large language models using semantic entropy.” Nature, 630(8017), 625–630. https://pmc.ncbi.nlm.nih.gov/articles/PMC11186750/
5. OWASP. (2025). “OWASP Top 10 for LLM Applications 2025.” https://genai.owasp.org/llm-top-10/
6. National Cyber Security Centre (UK). (2023). “Guidelines for secure AI system development.” November 27, 2023. https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development
7. Stanford Institute for Human-Centered AI. (2025). “The 2025 AI Index Report.” https://hai.stanford.edu/ai-index/2025-ai-index-report