Security slop: Generative AI models are exceptionally good at working with code, and vibe coding is now spilling over everywhere. So much so, in fact, that many open-source projects are struggling with an untenable volume of contributions if they want to keep a proper vetting process in place.
Google is temporarily pausing monetary rewards for capable bug hunters because its human staff can't keep up with the current influx of automated reports. The "vast majority" of these submissions are slop, Google warns, containing invalid information and hallucinated vulnerability data.
Tech Trivia: Which tech company launched the world's first bug bounty program?
The program being paused is Google's Open Source Software Vulnerability Rewards Program (OSS VRP), which the company designed to encourage capable researchers to report vulnerabilities in Google's own open-source projects. Researchers get paid for their findings, and Google benefits from better, more secure code in Go, Angular, Fuchsia, and other major FOSS codebases.
Then came vibe coding. The Google Bug Hunters team recently announced that the OSS VRP is no longer accepting product vulnerability submissions. The pause follows a significant rise in automated reports that put too much strain on reviewers. On top of that, the majority of these vibe-coded reports are simply useless.
– Google VRP (Google Bug Hunters) (@GoogleVRP) October 1, 2026
Google also updated the OSS VRP rules to say the program won't accept new vulnerability reports submitted after October 1, while reports filed before then are still being processed. Some Google Cloud repositories might still accept new reports, but the main VRP is being "reformatted" to cope with the new chaos vibe coding has brought to the open-source world. Google plans to share an update on the program's future in the first quarter of 2027.
Google is making a specific exception for supply chain reports, which can have a massive reach compared to other "simpler" bugs. Reports about particularly dangerous flaws are safe as well. In any case, Mountain View is directing capable bug hunters looking for a reward to other VRPs that still accept reports, as well as its Patch Rewards Program.
Vibe coding is now seeping into every open-source codebase with public access. Microsoft Edge, Linux, and other major FOSS projects are facing the same issues as Google, while smaller teams have simply decided to shut the door on AI-generated contributions to avoid being overwhelmed by slop.