Google 因 AI 提交激增暂停开源漏洞赏金计划
Google froze its open source bug bounty program due to a ‘significant rise’ in AI submissions
Google 以自动提交数量大幅上升、其中绝大多数无效为由，自 10 月 1 日起暂停其开源软件漏洞赏金计划，并承诺在 2027 年第一季度给出更新。据 Tom's Hardware 报道，Google 工程师和开源维护者被大量无效或含模型幻觉的报告淹没，期间参与者被建议转向 Google 的其他漏洞赏金项目。
推荐理由
AI 评分 62
Google 因 AI 自动提交激增暂停开源漏洞赏金计划，读者可了解 AI 生成低质报告对安全众测流程的实际冲击。
主题
正文
当前显示原文，中文全文译文尚未就绪。
Blaming a “significant rise” in AI submissions, Google has paused its open source bug bounty program until next year.
Last year, TechCrunch reported that cybersecurity experts were warning of that AI slop posed a serious risk to bug bounty programs . Looks like that’s the issue confronting Google’s Open Source Software Vulnerability Rewards Program, where researchers were rewarded for finding vulnerabilities in the company’s open source software.
In posts on X and the program website , Google said the bug bounty program was paused as of October 1, with a promise to provide “an update” in the first quarter of 2027. According to Tom’s Hardware , Google engineers and open source maintainers were overwhelmed by reports that were invalid or contained hallucinations.
“This pause is due to a significant rise in automated submissions, the vast majority of which are not valid,” the company said.
In the meantime, participants are encouraged to consider Google’s other bug bounty programs.