Google Suspends Open Source Bug Bounty Program Amid AI Report Surge
Google has temporarily suspended its Open Source Software Vulnerability Reward Program for product vulnerabilities due to an influx of invalid automated reports.
In response to a marked increase in automated submissions leading to an overwhelming number of invalid reports, Google has temporarily suspended product vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP). This decision was announced on October 1, 2026, through a post on X, outlining the company's concerns regarding the integrity of submissions received.
Reasons Behind the Suspension
Google cited the influx of automated reports as the primary trigger for this pause. According to the company, a significant majority of these submissions were not valid, which has made it challenging to filter through genuine vulnerabilities. The pause specifically affects only the product vulnerability submissions; however, it does not impact reports related to the software supply chain or any reports that were submitted prior to the cutoff date.
Impact on the Open Source Software Community
The suspension of the OSS VRP affects submissions for vulnerabilities across various high-profile open-source projects that Google maintains including Golang, Angular, Bazel, Protocol Buffers, and Fuchsia. It extends to critical third-party dependencies as well as repository settings like GitHub actions, application configurations, and access control rules. This vast range illustrates the program’s importance to the open source community, both in maintaining software integrity and in securing software supply chains.
Google’s Guidance for Researchers
In light of the pause, Google has recommended that researchers utilize other vulnerability reward programs which include:
- Cloud VRP: For vulnerabilities that impact Google Cloud products, researchers can still report findings.
- Patch Rewards Program: This program incentivizes the submission of security patches for open-source software, offering rewards up to $15,000 for high-impact fixes.
Google has also advised researchers to seek out potential impacts across other VRP programs where their submissions may be relevant.
Future Plans for the OSS VRP
Google has acknowledged the need to reformulate the OSS VRP and plans to provide an update in Q1 2027. This restructuring aims to address the issues stemming from automated submissions and enhance the program’s effectiveness. The company assures that this temporary measure is not a permanent closure and reiterates its commitment to revising the program for better alignment with the community's needs.
Background on the Bug Bounty Program
The OSS VRP was launched in August 2022 as part of Google’s initiative to encourage responsible disclosure of security flaws within their open-source projects. It provided rewards ranging from $100 up to $31,337 based on the severity and significance of the discovered vulnerabilities. Although the pause has temporarily halted submissions, Google reinforced that prior submissions before the suspension remain unaffected and that researchers can still seek rewards from existing reports.
Recent Trends in Artificial Intelligence and Vulnerability Reporting
This suspension of the OSS VRP is not an isolated case. Similar issues have been noted within other organizations as AI-generated reports overwhelm human assessment capabilities. For example, the Internet Bug Bounty program, managed by HackerOne, paused new submissions in March 2026 due to challenges posed by the volume of AI-assisted vulnerability discoveries.
As AI tools are increasingly used to identify vulnerabilities, organizations like Microsoft have also acknowledged the complexities these emerging technologies bring to vulnerability detection, warning that they could intensify operational demands across the industry.
Financial Impact and Rewards
Since its inception, Google’s various bug bounty programs have rewarded over $81.6 million to researchers, with a record payout of $17.1 million in 2025 alone. This demonstrates the company’s substantial investment in cybersecurity and its reliance on community engagement to bolster its defense strategies against vulnerabilities.
Google Vulnerability Reward Programs
| Program Name | Description | Maximum Reward |
|---|---|---|
| OSS VRP | For open source vulnerabilities. | $31,337 |
| Cloud VRP | Reports covering Google Cloud products. | Varies, based on vulnerability. |
| Patch Rewards Program | Incentivizes security patches for open-source software. | $15,000 |
Key Takeaways
- Google suspended product vulnerability submissions to the OSS VRP due to increasing invalid automated reports.
- This suspension began on October 1, 2026, and does not affect past submissions.
- Researchers are encouraged to submit findings through other reward programs like Cloud VRP and Patch Rewards Program.
- The OSS VRP was launched in August 2022 and has paid out over $81.6 million since its inception.
Conclusion
The temporary suspension of the OSS VRP highlights the growing challenges posed by automated submissions in the realm of vulnerability reporting. As Google refines its approach to this increasing issue, it remains committed to supporting the security research community through alternative programs, ensuring that it maintains a robust defense against emerging vulnerabilities. With updates planned for early next year, stakeholders in the open-source community will be watching closely to see how the program evolves to better address current challenges while encouraging responsible reporting and enhancing overall software security.
Frequently Asked Questions