Google 因 AI 提交量“显著增加”暂停开源漏洞赏金计划
英文标题：Google froze its open source bug bounty program due to a ‘significant rise’ in AI submissions
Google 表示，由于自动化 AI 提交量“显著增加”，已暂停其开源软件漏洞奖励计划（OSS VRP）。该计划自 10 月 1 日起暂停，Google 承诺将在 2027 年第一季度提供更新。报道称，Google 工程师和开源维护者正被大量无效或包含幻觉内容的漏洞报告淹没。这一事件凸显了 AI 生成的低质量安全报告正在加重漏洞赏金项目的审核负担，可能影响安全研究人员、维护者和平台的资源分配。
3.1 KB
389 B
141.1 KB
55.9 KB
202.2 KB
45.6 KB
39.2 KB
33.3 KB
54.6 KB
54.8 KB
248 B
177.1 KB
中文
Google 将其开源漏洞赏金计划暂停至明年，理由是 AI 提交内容“显著增加”。
去年，TechCrunch 曾报道，网络安全专家警告称，AI 低质内容正对漏洞赏金计划构成严重风险。看来，这正是 Google 开源软件漏洞奖励计划所面临的问题；在该计划中，研究人员可因发现该公司开源软件中的漏洞而获得奖励。
Google 在其 X 平台帖子及计划网站上表示，该漏洞赏金计划已于 10 月 1 日起暂停，并承诺将在 2027 年第一季度提供“一次更新”。据 Tom’s Hardware 报道，Google 工程师和开源维护者被大量无效或包含幻觉内容的报告压得喘不过气。
“此次暂停是由于自动化提交内容显著增加，而其中绝大多数并不有效，”该公司表示。
与此同时，Google 鼓励参与者考虑其旗下的其他漏洞赏金计划。
English / 原文
Blaming a “significant rise” in AI submissions, Google has paused its open source bug bounty program until next year.
Last year, TechCrunch reported that cybersecurity experts were warning of that AI slop posed a serious risk to bug bounty programs. Looks like that’s the issue confronting Google’s Open Source Software Vulnerability Rewards Program, where researchers were rewarded for finding vulnerabilities in the company’s open source software.
In posts on X and the program website, Google said the bug bounty program was paused as of October 1, with a promise to provide “an update” in the first quarter of 2027. According to Tom’s Hardware, Google engineers and open source maintainers were overwhelmed by reports that were invalid or contained hallucinations.
“This pause is due to a significant rise in automated submissions, the vast majority of which are not valid,” the company said.
In the meantime, participants are encouraged to consider Google’s other bug bounty programs.