Google paused an open source bug bounty after a flood of invalid AI reports. Your intake forms are next

When sending something costs nothing, your inbox stops being a signal. Google just learned that at scale.

What happened

Google has paused product vulnerability submissions to its Open Source Software Vulnerability Reward Program, effective October 1, with an update promised in the first quarter of 2027. "This pause is due to a significant rise in automated submissions, the vast majority of which are not valid," the company said, as reported by TechCrunch.

Tom's Hardware reports that Google engineers and open source maintainers were overwhelmed by thousands of poorly written reports that claimed bugs but were invalid or unexploitable hallucinations, and that they spent too much time validating reports instead of fixing real vulnerabilities. Reports submitted before October 1 are unaffected, supply chain reports still count, and some Google Cloud repos can still be reported through the Cloud VRP. The same article says Intel also suspended a bounty program, though Intel did not confirm AI reports as the reason.

My take

Bug bounties are just the first inbound channel to break. The same economics apply to your contact form, support inbox, job applications, partner sign ups and lead forms. When an AI script can fill in a form in a second, volume stops telling you anything about demand.

The fix is not to close the door. It is to put triage in front of it:

1. Ask for proof that is hard to fake. A bounty can require a working reproduction. A lead form can require a real company domain or a booked call.
2. Classify before a human sees it. A small model can sort spam, low effort and real enquiries into buckets in your CRM. This is cheap now.
3. Validate the claim automatically. If a message says "your checkout is broken", a workflow can hit the checkout and check before anyone gets paged.
4. Track the ratio. Watch invalid versus valid submissions weekly. A sudden jump is your early warning.

Here is what I watch for in client systems: a team stops trusting the inbox, so real leads sit unanswered. Triage protects the good messages as much as it filters the bad ones.

Putting a classification and validation layer in front of a lead form or support inbox is a normal part of the CRM work I do. If yours is starting to fill with noise, you can find me at romielwillautomate.dev.