Technology and Science03 October, 20262 min read
Google Suspends Open-Source Vulnerability Rewards Program After AI Submissions Surge
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Google paused new product vulnerability submissions to OSS VRP due to AI-generated invalid reports. The suspension is temporary with an update expected in early 2027.
OSS VRP Paused
Google suspended its Open Source Software Vulnerability Rewards Program, stopping the acceptance of new product vulnerability reports in its OSS VRP on October 1, 2026. Google said the pause was due to a "significant increase" in automated submissions, the vast majority of which are not valid, and the company pledged to provide an update in the first quarter of 2027. Google’s suspension preserved supply-chain reporting, and the measure did not affect product flaws submitted before October 1, 2026.
Google launched OSS VRP on August 30, 2022 to reward findings in its open-source projects, and the program aimed to address both product and supply-chain risk. Google’s official update described two problems, including AI-generated reports that "invented how a vulnerability was triggered" and real programming errors with minimal security impact or inaccessible execution paths.
AI Submissions Clash
Google told participants that the pause was a consequence of a "significant increase in automated submissions" and that the company was receiving overwhelming volume of false and confusing reports that complicated the work of engineers and maintainers. Tom's Hardware attributed the suspension to a surge of AI-generated invalid reports, and the outlet said the measure preserves supply-chain reports and does not affect product flaws submitted before October 1, 2026. Google’s March 19, 2026 update also described real programming errors whose security impact was minimal or that lay in inaccessible execution paths, and Google asked to validate AI results during the investigation.
Google’s April update removed monetary rewards and recognition for product vulnerabilities and other lower-level security issues, labeled OT2 and OT3, within the program’s framework. Google’s Cloud VRP documentation set conditions for valid findings, requiring an attack scenario and asking for impact, a proof of concept, and how to reproduce the flaw.
What Comes Next
Google committed to providing an update in Q1 2027, and the company encouraged participants to consider other bug bounty initiatives while the OSS VRP product vulnerability channel remained paused. Google’s OSS VRP rules distinguished product vulnerabilities from supply-chain issues, with product flaws appearing in design or implementation and supply-chain issues compromising code or the process by which it is built and distributed. Google said it may still accept reports covering product vulnerabilities through the Cloud VRP for some Google Cloud repositories impacting Google Cloud products, while OSS VRP supply chain reports remained open.
Google’s Cloud VRP scope focused on issues that substantially affect data confidentiality or integrity, and the documentation required a valid attack scenario plus proof of concept and reproduction steps. Google’s Cloud VRP also excluded rewards for reports obtained by probing client resources, limiting eligible investigation to Google infrastructure and services.