Google froze its open source bug bounty program due to a ‘significant rise’ in AI submissions

TechCrunchOct 4, 2026Oct 4, 2026, 4:31 PM AST

Bug bounty programs pay researchers who find real flaws in widely used software, but AI tools can now produce floods of plausible reports that turn out to be invalid or invented. Google paused its Open Source Software Vulnerability Rewards Program on October 1, saying the vast majority of a big rise in automated submissions were not valid, and it promises an update in the first quarter of 2027.

Summary written with AI by HowTechMoves, based on reporting by TechCrunch.

All tech news

Cybersecurity
ipinfo.ioOct 16, 2026
RPKI now protects 70% of internet routes
Networks tell each other where to send traffic using the Border Gateway Protocol, a system built on trust, so one wrong announcement can hijack a site, as when Pakistan briefly redirected YouTube in 2008. RPKI fixes that by having address owners publish signed records naming which networks may announce their addresses. The share of protected routes rose from 54 to 70 percent in a year.
Read original at ipinfo.io (opens in a new tab)
Cybersecurity
Ars TechnicaOct 15, 2026
Targeted ads delivered 0-click exploits to install mercenary malware
Zero-click attacks infect a phone without the owner tapping anything. Citizen Lab found that mercenary hackers bought targeted ads carrying code that reached control servers, which then delivered spyware to selected devices, including 45 phones at the Al Jazeera media network in 2024 and 2025. Google and ad platforms have since removed the vendor involved.
Read original at Ars Technica (opens in a new tab)
Cybersecurity
The VergeOct 14, 2026
Android is using AI to suss out scammers in Google Messages
Google Messages checks texts on-device for scam signs; a new opt-in mode sends chats with unknown senders to cloud Gemini models that look for slow manipulation, with data encrypted and handled in a space Google says it cannot see. Gemini Nano also vets links before you open them, and Google is adding call-forwarding blocks and screen-sharing privacy, plus scam alerts on more Android brands.
Read original at The Verge (opens in a new tab)
Cybersecurity
BleepingComputerOct 14, 2026
Cisco patches new Secure Email Gateway zero-day exploited in attacks
Cisco fixed a zero-day, CVE-2026-76519, in its Secure Email Gateway, an appliance organizations use to scan mail. A crafted email attachment triggers a path traversal bug in its attachment scanning, letting an unauthenticated attacker write files and run commands as root. Cisco says it saw exploitation this month and advises rotating credentials and limiting access.
Read original at BleepingComputer (opens in a new tab)

Related stories