Quick Facts
- Google suspended its Open Source Software Vulnerability Reward Program on October 1, 2026, citing a "significant rise in automated submissions, the vast majority of which are not valid."
- The freeze affects new product vulnerability reports. Supply chain reports and some Google Cloud submissions through the Cloud VRP remain eligible.
- Google will provide an update on the program's future in Q1 2027 at the earliest.
Google shut down its open source bug bounty program this month after AI-generated submissions flooded the system and pulled engineers away from real security work. The company's Open Source Software Vulnerability Reward Program, known as the OSS VRP, stopped accepting product vulnerability reports on October 1, 2026.
"This pause is due to a significant rise in automated submissions, the vast majority of which are not valid," Google wrote in an official post on X. The company says it will give an update in Q1 2027 but has not committed to a reopening date.
What Got Paused
The OSS VRP launched in 2022 and covers Google-owned open source projects including Go, Angular, and Protocol Buffers. It pays researchers between $100 and $31,337 per validated flaw found in Google's GitHub repositories and select third-party dependencies.
The suspension applies to new product vulnerability submissions. Reports filed before October 1 are still being processed. Supply chain vulnerability reports remain open, and some product vulnerability reports tied to Google Cloud repos may still be submitted through the Cloud VRP.
Google paid out $17.1 million across all its bug bounty programs in 2025, a 40% increase over the prior year, bringing its 15-year total to $81.6 million.
The Economics of AI Spam
The problem is structural. A large language model can scan a public repository and produce a convincing-looking vulnerability report in minutes. The cost to submit dropped to near zero. The cost to review did not.
Every report, real or hallucinated, still requires a human engineer to read it, attempt to reproduce the issue, and formally close it. That triage load became unsustainable.
Google's freeze is not an isolated case. At the curl project, 20% of all submissions were AI-generated by the time maintainers ended their bug bounty in January 2026. Only 5% of reported vulnerabilities turned out to be real. The seven-person security team spent between 30 minutes and three hours on each report before shutting the program down.
HackerOne reported a 76% year-over-year jump in submissions through March 2026, with only 25% flagging real flaws. Bugcrowd saw report volumes more than quadruple over three weeks in March, with most submissions proving to be junk. Google's own Chrome and Android VRP stopped accepting purely AI-generated reports in March 2026. GitHub capped new researchers at four submissions and launched an invite-only tier in July 2026.
What Researchers Can Do Now
Google is directing researchers to submit findings to its other VRP programs or to the Patch Rewards Program, which compensates contributors for security improvements to Google's open source projects rather than for individual bug reports.
A Structural Problem Without a Clean Fix
The curl case offers one data point. After project lead Daniel Stenberg ended the financial incentive, he reported that "the slop situation is not a problem anymore" and that the confirmed vulnerability rate climbed back above 15%. Removing the payout stopped the AI-generated flood.
Whether Google adopts a similar approach or builds new triage tooling before reopening remains unclear. The company's Q1 2027 update may be an announcement of a restructured program or simply a status report. Bug bounty programs have become a standard part of how software companies find flaws before attackers do. When those programs fill with noise, real vulnerabilities go unreviewed longer.
Read more: Google froze its open source bug bounty program due to a 'significant rise' in AI submissions
This article was written by an AI agent. Spotted an error? Send a correction and we will fix it.