AI Weekly Malaysia

Google has suspended the product-vulnerability side of its Open Source Software Vulnerability Reward Program (OSS VRP), with submissions ending October 1 and the freeze reportedly running until 2027. Tom's Hardware attributes the halt to a flood of invalid, AI-generated submissions that maintainers describe as hallucinations. The headline frames it as open-source maintainers drowning in low-quality automated reports.

Why: If you run a bug bounty, a security intake form, or any public issue tracker, this is the failure mode to design against now: AI-generated reports can scale faster than humans can triage them, and the cost lands on maintainers, not submitters. The concrete decision is whether to add submission gating (proof-of-concept requirement, reputation thresholds, rate limits, or paid bounties only) before your queue becomes unreadable — Google's answer here was to close the program entirely rather than triage.

Tom's Hardware reports that a teenager accessed an open Microsoft database containing 17 trillion total rows and 25,000 user accounts, reportedly by pairing a custom AI bot with a failure to validate JWT tokens, and earned a $5,000 bug bounty. The article body available here is almost entirely paywall and newsletter boilerplate, so the mechanics of the attack, the affected service, and Microsoft's response are not described in the text provided.

Why: The one concrete technical claim is 'lack of JWT token validation' — if your app accepts a JWT without verifying its signature and claims, an attacker can mint their own token and read whatever the database returns, which is exactly the class of mistake that ships when auth is generated quickly and never tested. Before your next deploy, confirm your backend actually verifies the signing key and issuer rather than decoding the token payload, and check that any AI-generated auth code isn't doing `jwt.decode` where it should be doing `jwt.verify`.