What changed
On October 1, Google paused its Open Source Software Vulnerability Rewards Program. This is the program where security researchers submit reports about bugs they find in Google's open-source code, and Google pays them if the bug is real. Google said thousands of AI-generated reports flooded the system in recent weeks. Most were invalid. Many contained hallucinations: bugs that do not exist, code paths that are not real, problems that cannot be reproduced. Engineers and open-source maintainers spent hundreds of hours reading these reports and testing them, only to find they were made up. The program will stay paused until at least early 2027 while Google figures out how to filter AI spam.
What you can do with it this week
If your team accepts work from outside contributors, freelancers, agencies, or the public, this is your warning shot. Set up a checkpoint before AI-written work reaches the person who has to act on it. One clinic owner told me she now has her assistant read every patient inquiry twice: once for the question, once to see if it sounds like a person wrote it. If you get applications, proposals, or reports from people you do not know, make someone check a sample by hand before you waste time on all of them. Better: ask for a specific detail only a real human in your situation would know. The people using AI to spam you are counting on you to read everything. Stop reading everything. Decide what you will ignore and ignore it fast.
What to keep in your own hands
Do not let AI write anything your customers, your suppliers, or your team will have to spend time reading if it might be wrong. Customer support replies, proposals, technical reports, medical summaries, contracts: these need a human who knows the situation to read them before they go out. The cost is not the AI subscription. The cost is your billing manager spending Friday afternoon chasing down a hallucinated invoice number, or your client reading a proposal that quotes a service you do not offer. If you use AI to draft these, have the same person who would have written it review it as if they did write it. If they would not have had time to write it, they do not have time to check it properly either. Do not send it.