Overview
- Google stopped accepting new product vulnerability reports to its Open Source Software Vulnerability Reward Program on October 1, 2026, while continuing to process reports filed before that date and exempting supply-chain reports and some Cloud-related submissions.
- The company said a large wave of automated, AI-generated reports often contained hallucinated or negligible issues and the manual work to read, reproduce and validate each claim overwhelmed security teams.
- Small and volunteer open-source maintainers bore the brunt of the surge because they lack the staff or time to triage large volumes of dubious reports.
- Legitimate security researchers will lose some OSS VRP earning opportunities and Google is directing them to other programs such as Cloud VRP and its Patch Rewards offering.
- The pause is the most aggressive step after March 2026 rule tightenings and follows similar disruptions at other programs, so the Q1 2027 policy update will be a key test of whether bounty models can be adapted to control AI-driven noise.