Google Pauses Part of Its Open Source Bug Bounty as AI-Generated Reports Pile Up
As of October 1, Google is no longer accepting product vulnerability reports through its OSS VRP. Supply chain reports continue, and Google says it will share an update on the overhaul in the first quarter of 2027.
Starting October 1, Google stopped accepting product vulnerability reports through its Open Source Software Vulnerability Rewards Program (OSS VRP). A vulnerability is a security flaw that attackers can exploit. Google attributed the pause to a sharp rise in machine-generated submissions, most of which turned out to be invalid. Researchers hoping to earn a reward for finding security issues in Google’s public software will now need to double-check where their report belongs.
What’s on hold
The pause applies only to the product vulnerability portion of the OSS VRP. Supply chain reports, which cover the security of how software is built and distributed, are still being accepted. Reports submitted before October 1 will be processed as usual.
Product vulnerabilities in certain code repositories that affect Google Cloud products can still be submitted through a separate program, Cloud VRP. Google also pointed researchers toward its other vulnerability rewards programs and its patch rewards program.
The steps that led here
Google had already tightened its reporting rules twice before halting intake. In March 2026, citing a surge in AI-generated reports, it raised the bar for demonstrating that a security issue was real. Unverified submissions and reports with negligible security impact were also cited as reasons for that change. In April, it decided to withhold both cash and credit for certain product vulnerability reports involving lower-priority projects.
The current pause follows those incremental moves. Where the earlier changes adjusted proof requirements and the scope of what qualified for a reward, this pause stops the intake of new product vulnerability reports. Google has not disclosed the number or share of invalid reports it received.
The OSS VRP launched in August 2022. It rewarded researchers who found and reported vulnerabilities that could lead to supply chain compromise in Google’s public open source projects, as well as design flaws that give rise to product vulnerabilities. Payouts varied with the severity of the issue and the importance of the project, ranging from $100 to $31,337 at launch.
Where researchers should go now
Researchers in Korea who examine Google’s open source projects will likewise need to start by working out which channel their finding falls under. Supply chain reports and already-submitted reports are unaffected, but new product vulnerability reports are not being accepted. If the issue touches a cloud product, the next step is to check whether it falls within the repositories and vulnerability types that Cloud VRP covers.
Google says it will provide an update in the first quarter of 2027. It has not announced a date for reopening submissions. That leaves researchers watching two things: what kind of proof the new intake process will demand, and when product vulnerability reports will be accepted again.