Google pauses its open-source bug bounty after a flood of AI-generated reports

As of October 1, 2026, Google is no longer accepting product vulnerability submissions to its Open Source Software Vulnerability Rewards Program, or OSS VRP.

"We are temporarily no longer accepting OSS VRP product vulnerability submissions," Google said, as quoted by BleepingComputer. "This does not impact OSS VRP supply chain reports, or any outstanding reports."

The reason, in Google's words: "This pause is due to a significant rise in automated submissions, the vast majority of which are not valid."

Google announced the change in posts on X and on the program's website, TechCrunch reports. The program's rules page now states that "as of October 1, 2026, we are no longer accepting product vulnerabilities submitted to the OSS VRP," according to Help Net Security.

Help Net Security also reports that the reward table on the program's page now lists no amounts for product vulnerabilities in any of its four project tiers.

The OSS VRP is Google's bug bounty for the open-source software it releases. It pays security researchers who find and privately report security flaws, BleepingComputer explains.

• Launched: August 2022
• Rewards: from $100 to $31,337
• Projects covered: Google-maintained open source like Go (Golang), Angular, Bazel, Protocol Buffers and Fuchsia, plus critical third-party dependencies
• Also covered: repository settings like GitHub Actions, app configurations and access controls

Google said the program would focus on flaws with the biggest impact on the software supply chain, BleepingComputer reports.

The paused part of the program covered a wide range of problems. Under the program's scope, "any design or implementation issue in Google OSS that causes a product vulnerability substantially affecting the confidentiality or integrity of user data in software builds using Google OSS" was eligible, Help Net Security reports.

Projects were sorted into four tiers, from OT0 (Flagship) to OT3 (Low-priority), and whether a report was accepted depended on the project's tier and the type of vulnerability, according to Help Net Security.

That breadth is part of the problem. A wide scope plus easy automation means a lot of reports to check, and every one has to be reviewed by a person before anyone can tell whether it's real.

Why it matters: bug bounties only work if the reports are worth reading. TechCrunch notes that cybersecurity experts warned last year that AI-generated "slop" posed a serious risk to bug bounty programs. Google's pause is one of the clearest signs yet that the warning came true.

The big picture: finding software bugs used to be slow, skilled, manual work. AI tools have changed that.

Tom's Hardware explains that finding and reporting these flaws was usually painstaking, manual work that required real skill. Large language models and automated bug-hunting scripts have nearly eliminated that cost and effort, which led to a flood of low-effort reports.

In other words, the barrier that used to keep reports rare, and mostly real, has largely disappeared.

==Google engineers and open-source maintainers were reportedly swamped by thousands of reports that claimed to find bugs but were invalid, unexploitable or outright hallucinations, Tom's Hardware reports.==

The result was that reviewers spent too much time checking fake findings instead of fixing real, critical vulnerabilities.

In real life Imagine running a lost-and-found where suddenly thousands of people report wallets that never existed. You'd spend all day checking claims instead of returning the real ones. That's roughly what happened here.

The pause is narrower than it might sound. According to Google, as reported by BleepingComputer and Help Net Security:

• Supply chain reports to the OSS VRP are still accepted.
• Earlier reports: product vulnerabilities submitted before October 1 aren't affected.
• Patch Rewards Program: researchers can still submit security patches for Google's open source, with bounties of up to $15,000 for high-impact fixes.
• Cloud VRP: Google says it may still accept product vulnerability reports through the Cloud VRP "for some Google Cloud repos impacting Google Cloud products," Tom's Hardware reports.
• Other VRPs: Google encourages researchers to "find impact across our other VRP programs and submit there instead."

What's next: Google says it's reworking the program.

"We will continue to reformat and work on this aspect of the OSS VRP and commit to giving an update in Q1 2027," Google said in an update on its Bug Hunters website, as quoted by BleepingComputer.

The catch: Google hasn't said what will change, or whether product vulnerability rewards will return in the same form.

For context, Google's bug bounties are big business. Since its first program in 2010, Google has paid more than $81.6 million to security researchers. In 2025 it paid a record $17.1 million to more than 700 researchers, up 40% from $12 million in 2024, BleepingComputer reports.

Yes, and it's becoming a pattern.

• curl: in January, the maintainer of the popular curl tool ended the project's HackerOne bug bounty after being overwhelmed by AI-generated reports, BleepingComputer reports.
• Intel: in mid-September, Intel removed all financial rewards for flaws in its software, firmware, hardware and services reported through its Intigriti bug bounty program, which had paid up to $100,000 per flaw, according to BleepingComputer and Tom's Hardware. It hasn't explained why, and Tom's Hardware notes experts suspect AI reports played a part.
• Linux: Tom's Hardware reports that Linux kernel maintainers said this month they were "completely overwhelmed," as AI-powered bug hunters pushed the kernel to a record 2,000 vulnerabilities per release.
• Microsoft: it warned in May that AI tools are increasing the pace of vulnerability discovery and "can raise operational demands," BleepingComputer reports. Last month, Microsoft patched a record-breaking 966 flaws, including two actively exploited zero-days.
• Older Linux drivers: in a similar case, Tom's Hardware says Linux ended support for some older network drivers because of an influx of false AI-generated bug reports.

Help Net Security adds that the decision follows months of complaints from open-source maintainers and bug bounty programs about low-quality, AI-assisted reports.

For more on Google, see our Google topic page.

• If you're a security researcher: OSS VRP product reports are paused, so send findings to Google's other programs or the Patch Rewards Program.
• If you use AI to hunt bugs: verify findings before submitting. Unchecked reports are what triggered this pause.
• Watch for early 2027: Google has committed to an update on the program in the first quarter of 2027, which should show how it plans to handle automated reports.
• If you rely on open source: the pause doesn't mean less security work. Google says the goal is to free reviewers to focus on real issues.