Hook
Over the past reporting cycle, the marginal cost of asserting that a vulnerability exists collapsed to approximately zero. The marginal cost of verifying that assertion did not move a single basis point. That asymmetry — not any specific model, not any specific exploit — is the entire story behind Google's decision to pause its open source bug bounty program.
The public sees the spark: a search giant switching off a program it spent years funding. I track the fuel lines. Those lines were laid long before any large language model learned to parse a stack trace.
Google did not stop paying for bugs because it found too few. It stopped because it received too many reports and could afford too few hours to read them. The trigger, as reported, was that AI-generated reports piled up. Quantity, not quality, was the detonating charge. That distinction matters more than the headline. A quality collapse is a tooling problem, solvable with better filters. A quantity collapse against fixed verification capacity is a structural problem, and structural problems do not get patched by better filters. They get repriced.
The ledger doesn't forgive a system that prices submission at zero and verification at market rate. It simply records the loss.
Context
Open source security has always run on an implicit bargain. The people who consume code are not the people who maintain it. The people who find the flaws are almost never the people who fix them. Bug bounties were the bridge across that gap: a researcher submits a finding, a vendor pays for the finding, the public inherits a safer dependency. The mechanism is elegant, and it depends on one assumption so obvious it is almost never written down — that submitting a report costs the submitter something. Time, reputation, the risk of being wrong.
Every bounty program in existence, from the smallest vendor-run scheme to Google's own, is a two-sided market. On one side sits the enterprise, buying verified vulnerability intelligence at a price it believes reflects risk reduction. On the other sits the researcher, converting skill into money. In the middle sits the platform — HackerOne, Bugcrowd, or, in crypto, Immunefi — skimming a fee for matching the two. The economics of that market assume submission cost is greater than zero. It is the only thing keeping the supply side honest. A researcher who must spend a day proving a flaw does not submit ten speculations. The cost filters the field before any human reviewer opens a queue.
AI deleted that filter. Not gradually. Not at the margin. It took the cost of producing a plausible-sounding vulnerability report — a title, a severity score, a reproduction narrative, confident prose — from a day of skilled labor to a few seconds of inference. The submission side of the market did not become cheaper. It became free.
This is not an isolated event, and that is what makes it a signal rather than an anecdote. The curl maintainer Daniel Stenberg has publicly described drowning in AI-generated security reports that were technically coherent and factually empty. Academic journals and conference program committees are processing a flood of machine-authored submissions with the same structural profile: low-cost input, high-cost review. Content moderation teams ran this experiment years ago. What arrived at Google's bounty is the same disease, newly visible because security review is the most expensive form of review that exists.
One detail deserves the forensic treatment. The reporting says Google paused the program, not that it terminated it. Language in official statements is never accidental. A pause is a temporary defensive posture, which tells you the company is still evaluating replacements rather than declaring the model dead. It also tells you the noise arrived faster than any internal countermeasure could be fielded. And it is worth noting who carried the story. A crypto publication picked up an AI topic. That is not coincidence. It is a tell, and the fuel lines run straight through it.
Core
Here is the mechanism, traced the way I trace any liquidation cascade: from the outside in.
The first layer is the trust good. A vulnerability report is not a product you can inspect before purchase. It is a claim. The submitter asserts a state of the world — this code fails under this input — and the verifier must spend expert attention to confirm or refute it. Trust goods have a specific failure mode: they are only as valuable as the verification behind them, and verification cannot be scaled by throwing cheap labor at it. You cannot outsource the judgment that decides whether a memory-safety bug is real. You can only buy more of the same scarce expertise, at a cost that does not fall.
The second layer is the scissors. AI compressed one blade of the cost function and left the other fixed. Submission cost went to zero. Verification cost stayed rigid, because it is bounded by human judgment, and human judgment does not deflate on a compute curve. When one blade falls and the other holds, the gap between them becomes a quantity nobody can absorb. Reports inflate. Review capacity does not. The queue becomes the product.
The third layer is the incentive flip. Before AI, spray-and-pray bounty hunting had negative expected value. You spent real hours, you mostly found nothing, and the occasional payout had to cover the failures. AI changes the arithmetic. If a report costs seconds and even a small fraction of reports land, the expected value of mass submission turns positive. The rational move for a marginal actor is no longer to hunt carefully. It is to generate volume and let reviewers sort it. That is not malice. It is arithmetic responding to a price signal the platform accidentally set to zero.
Put the three layers together and the outcome is not surprising. It is inevitable. Google, which employs one of the strongest security teams on earth, chose to pause rather than automate. That choice is the most important data point in the entire episode. If a company with Google's engineering depth, and Google's access to frontier AI tooling, concluded that available automated filtering was insufficient to separate signal from machine-generated noise, then the current ceiling of AI-versus-AI detection in security is lower than the marketing suggests. This is an ability boundary signal, and it should be read as one. The company that builds the models could not build a filter good enough to keep its own bounty open.
I have run this kind of forensic accounting before, and the pattern is familiar. In 2017, I audited a token sale against its on-chain deployments and found that the whitepaper's escrow promises did not exist in the contract — 60% of raised capital, roughly $4.2 million, sat in unverified wallets with no timelock and no multisig discipline. The whitepaper said one thing; the bytecode said another; the bytecode won. In 2022, I spent four weeks mapping the Terra/UST death spiral, and the lesson was identical in structure: the visible collapse was downstream of an incentive misalignment that had been priced in for months. The spark was the depeg. The fuel lines were the seigniorage mechanics and a yield that could only be paid from new entrants.
Google's pause is the same shape. The spark is a program going quiet. The fuel lines are a market that priced submission at zero and forgot that verification was the product all along.
Two categories of noise are almost certainly tangled in that queue, and separating them is where the cost actually lives. The first is the true-but-worthless report: a real, low-severity, already-known issue, restated with fresh confidence. The second is the pure hallucination: a plausible vulnerability that does not exist, described in the language of one that does. A human reviewer pays for both. The first wastes triage time. The second wastes triage time and, worse, burns reviewer trust, because a reviewer who cannot tell them apart starts discounting everything. That is the real damage — not the wasted hours, but the erosion of the reviewer's ability to believe any report at all.
There is a fourth layer, and it is the one the industry will feel last and hardest. Verification is not a cost center you can starve without consequence. It is the immune system of the software supply chain. Starve it, and the flow of genuine high-severity findings slows — not because there are fewer bugs, but because the humans who find them get discouraged by the noise and walk away. Programs that respond by adding submission friction, such as staking requirements, risk the opposite failure: they deter the careful researcher along with the spammer. There is no clean dial here. Every setting trades one failure for another.
Contrarian
Now the part the doomsayers get wrong, because a cold read has to survive its own contrarian test.
The noise is not evidence that AI cannot find real bugs. It is evidence that AI found the easiest thing to generate first. The genuinely valuable direction — AI that discovers true vulnerabilities rather than narrating fake ones — is already producing results. Google's own automated vulnerability research and independent efforts have demonstrated that machine reasoning can locate real memory-safety flaws in hardened codebases. That capability is real, and it is improving. The pile-up of junk reports is the exhaust of a working engine, not proof the engine is broken.
So the bullish read has a legitimate core: this episode is the visible cost of a capability that will, on net, make software safer. Fuzzing once looked like noise too. Static analysis once flooded teams with false positives before it matured into a standard layer. Every verification industry passes through a phase where generation outruns filtering, and the filtering eventually catches up as a market forms around it.
Where the bulls are blind is in the timeline and the mechanism. They assume the filter arrives as a product. It may arrive as a price. The honest reading of Google's move is not that AI broke bug bounties. It is that bug bounties were always underpriced on the verification side, and AI simply revealed the subsidy. Open source security has leaned for two decades on volunteer labor and a handful of corporate grants — a supply side with almost no elasticity and almost no tolerance for noise. That fragility predates the models. The models just stopped hiding it.
The crypto angle deserves its own cold note, because it is where the cheating incentive is strongest. Web3 bounty platforms routinely advertise payouts in the millions for a single critical finding. When the prize is that large, the expected value of mass-generating reports crosses into positive territory far sooner than at a conventional vendor program. This is precisely why a crypto outlet carried an AI story. The structural risk that pushed Google to pause is amplified, not diminished, in the segment that pays the most per valid report. The players with the biggest bounties have the biggest noise problem, and they have not yet said so out loud.
Takeaway
The single most informative signal to watch is not whether Google restores the program. It is the conditions under which it restores it. If the program returns with automated triage as a hard gate, the market has repriced verification upward and the tooling caught up. If it returns unchanged, the pause was a staffing stopgap and nothing was learned. If it does not return, the open source security model just lost a major funder, and the real cost will surface years later as unfound flaws in dependencies nobody is watching.
The ledger doesn't lie about where value moves. Watch for stake-based submission on the bounty platforms, watch for a distinct market in AI-report detection that migrates from text into code, and watch whether the largest crypto bounties quietly raise their verification budgets before their queues break the same way. The public will see another spark when the next program pauses. I will already be tracing the fuel lines.
The question is not whether AI can generate a vulnerability report. It clearly can. The question is who pays to read it, and whether the system that decides is still solvent when the queue doubles again.