Google has temporarily stopped accepting product vulnerability reports through its Open Source Software Vulnerability Rewards Program (OSS VRP). The Google bug bounty change follows a sharp increase in automated submissions, most of which the company says are invalid.
However, the suspension covers only part of the program. Supply chain reports remain eligible, and Google will continue handling outstanding submissions.
The company also says the change does not affect product vulnerability reports submitted before October 1, 2026.
Invalid Reports Prompt a Program Review
Google attributes the pause to the volume of automated reports reaching its security teams. The announcement comes amid growing concern about low-quality, AI-generated vulnerability submissions.
Although automated tools can help researchers identify weaknesses, their findings still require validation. A large volume of incorrect reports can therefore increase the workload for teams reviewing potential security issues.
Google is now revising the product vulnerability portion of OSS VRP. It has committed to providing an update in the first quarter of 2027, but it has not announced a reopening date.
Supply Chain Reports Remain Open
Google launched OSS VRP in August 2022, offering rewards ranging from $100 to $31,337. The program emphasized vulnerabilities with a significant potential impact on the software supply chain.
Its scope included Google-maintained projects such as Go, Angular, Bazel, Protocol Buffers and Fuchsia, alongside critical third-party dependencies.
It also covered certain repository and configuration weaknesses, including GitHub Actions workflows and access controls.
Despite the current restriction, Google continues accepting OSS VRP supply chain reports. Consequently, the announcement does not represent a shutdown of the entire program or Google’s wider vulnerability reward efforts.
Researchers Can Use Other Reward Programs
Researchers still have alternative routes for eligible security work.
The Google Patch Rewards Program accepts qualifying security improvements to open-source software. It offers payments of up to $15,000 for high-impact fixes.
Meanwhile, researchers can submit vulnerabilities in Google Cloud open-source repositories through Cloud VRP when those issues affect Cloud products.
Google also encourages researchers to investigate eligible issues across its other programs. However, submissions must meet the requirements of the relevant program.
The wider Google bug bounty initiative has paid researchers more than $81.6 million since its first vulnerability rewards program launched in 2010. In 2025 alone, Google awarded $17.1 million to more than 700 researchers.
Other Security Programs Face Similar Pressure
Google’s decision follows earlier concerns about AI-generated security reports across the software industry.
In January, curl’s maintainer ended the project’s HackerOne bounty program after receiving an overwhelming stream of low-quality AI-generated submissions.
Intel also removed financial rewards from its Intigriti program in September. However, the company has not explained that decision, so its reasons remain unclear.
Separately, Microsoft has warned that AI-assisted vulnerability discovery can increase operational demands on security teams.
For Google, the immediate response is a targeted pause while it reassesses how to handle automated submissions. Supply chain reporting, existing cases and other eligible reward routes remain available.
0 responses to “Google Pauses Open-Source Bug Reports After Automated Submission Surge”