Google Suspends Open Source Bug Bounty Program Following Deluge of AI Reports

Suspension of the OSS VRP Submission Pipeline

Google announced a temporary suspension of new product vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP) in early October 2026. The pause responds directly to an unsustainable surge in automated, low-quality submissions generated by artificial intelligence tools.

The bug bounty initiative was originally created to compensate independent security researchers who identify exploitable flaws across Google-supported open source repositories. However, widespread adoption of large language models for bulk code analysis triggered an influx of speculative submissions that triage engineers refer to as reporting storms.

A large portion of incoming reports contained model hallucinations, false positive static analysis outputs, or theoretical vulnerabilities lacking working proof-of-concept exploits. Reviewing these invalid tickets drained hundreds of engineering hours from maintainers tasked with manual triage.

Scope and Policy Exceptions

The pause does not shut down all of Google's vulnerability intake operations. The company outlined specific boundaries for the temporary freeze:

• Suspended category: New product vulnerability reports targeting open source software within the OSS VRP scope.

• Active category: Reports detailing supply chain security compromises continue to be accepted and processed.

• Pending submissions: Reports filed prior to October 1, 2026, will proceed through normal validation and payout workflows.

• Alternative channels: Vulnerabilities affecting Google Cloud repositories with direct impact on cloud services remain eligible under the Google Cloud VRP.

Restructuring the Intake Architecture for 2027

Google plans to use the hiatus to redesign its report intake and verification pipelines:

• Mandatory proof of concept: The restructured portal will require functional, reproducible reproduction scripts before a ticket reaches human review queues.

• Automated validation gates: Pre-triage filters will test submitted payloads in sandboxes to discard hallucinated findings automatically.

• Program timeline: Google committed to delivering an updated operating framework and announcing next steps by the first quarter of 2027.

Lessons for Cybersecurity Ecosystems

The suspension of the OSS VRP highlights an operational imbalance in modern software security. While generative tools drastically reduce the cost of producing technical reports, the burden of validating claims remains constrained by human review capacity.

For organizations running vulnerability disclosure programs, implementing verifiable execution gates has become an operational requirement to protect engineering resources from automated noise.