Google has frozen its open source bug bounty program. The official reason points to a significant rise in AI-assisted submissions. Behind that dry wording lies a problem that extends beyond any single company: AI slop is overwhelming vulnerability reporting channels, turning a trust mechanism into a stream of noise.

Bug bounty programs depend on a delicate balance. Whoever finds a real vulnerability invests time and expertise to document it, and is rewarded only if the report passes triage. Maintainers quickly filter candidates to focus on concrete threats. When an LLM generates plausible but unverified reports, the verification cost falls entirely on those who must separate signal from noise. False positives do not need to dominate; it is enough that they grow sufficiently to slow queues and reduce response capacity.

Google's decision has a second-order effect that is rarely considered: it alters incentives across the ecosystem. Independent researchers, already competing for attention in public programs, find themselves buried under synthetic submissions. Some may shift to private programs or less transparent markets, reducing the availability of quality public disclosures. Smaller open source projects, which rely almost entirely on these channels to discover bugs, risk losing their safety net. In this scenario, the loser is not only Google but the collective ability to find and fix vulnerabilities before they become incidents.

For those running self-hosted infrastructure or evaluating on-premise deployments, the episode carries a less obvious meaning. Many local and air-gapped stacks use open source components heavily: libraries, runtimes, orchestration tools. If the bug bounty programs that guard them slow down, the exposure window lengthens. This is not a cloud-versus-on-premise issue; it is a software supply chain issue. The quality of public vulnerability reporting is a common good that underpins trust in open source software. Its congestion ripples out to teams that must plan patches and updates without a steady flow of verified reports.

The structural lesson is easy to state but hard to absorb: the marginal cost of synthetic generation has collapsed, while the cost of human verification has not. This asymmetry will not be solved by larger models or more aggressive filters. It requires rethinking reputation, identity, and triage mechanisms. Until then, bug bounty programs will remain a faithful mirror of a broader tension: the infrastructure of digital trust is not yet ready for the era of generative AI.