Google has suspended product vulnerability submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP), effective October 1, 2026. The company attributed the pause to "a significant rise in automated submissions, the vast majority of which are not valid," and committed to providing an update in the first quarter of 2027 — a promise of an update, not a guarantee the program reopens.
The scope is narrower than a full shutdown. The suspension covers product vulnerability submissions — code defects, logic errors and design bugs in Google's public repositories. Reports submitted before October 1, 2026 continue to be processed under the previous rules, and OSS VRP supply chain reports are unaffected. Google also says some Google Cloud repositories may still accept product vulnerability reports through the Cloud VRP.
Google directed researchers to its other active channels in the meantime: the Cloud VRP, the AI VRP, and the Patch Rewards Program, which pays up to $15,000 for high-impact fixes to open-source software.
The reported cause is that manual triage broke down under volume. According to Tom's Hardware, Google engineers and open-source maintainers were overwhelmed by thousands of poorly written reports that claimed to find bugs but were completely invalid or unexploitable hallucinations. Time that should have gone to fixing real, critical vulnerabilities was spent manually validating code that turned out to describe nonexistent flaws.
Google's is the largest and most influential program to retrench in this cycle, according to industry coverage, but it is not the first. The curl project ended its bug bounty on January 31, 2026, after maintainer Daniel Stenberg said AI-generated reports arrived faster than the project could triage them. The confirmed-vulnerability rate on curl reports fell from roughly one in six — about 15–16% — to one in twenty or thirty. The program had confirmed 87 vulnerabilities and paid out over $100,000 across its lifetime.
GitHub restructured its vulnerability bounty program effective July 27, 2026, citing a queue flooded with "low-quality and AI-generated reports," shifting from range-based to fixed rewards and limiting submissions from new researchers. Intel suspended a bug bounty program that paid up to $100,000 per flaw; the company has not officially named AI-generated reports as the reason, but external experts widely suspect it. Linux kernel maintainers, describing themselves as "completely overwhelmed" by false AI-generated reports, ended support for some older network drivers rather than keep spending time on invalid reports.
The same year also produced the strongest results in the history of machine-assisted discovery. HackerOne's ninth annual report found valid AI-related vulnerability reports up 210% year-over-year, and Anthropic said its Mythos Preview model found high-severity vulnerabilities "including some in every major operating system and web browser." Both trends are supported by the data, and they point to the same structural problem: generating a plausible vulnerability report has become nearly free, while proving it is real remains expensive.
It remains unclear whether the suspension will resolve the problem or merely shift the burden to other programs. Observers note the outcome depends on whether future intake mechanisms add credibility thresholds, proof-of-concept requirements, or deposit models — and that the pause moves the triage cost back onto Google and other programs rather than changing the underlying incentive.
What is confirmed: the OSS VRP product vulnerability suspension began October 1, 2026; pre-existing product reports and all supply chain reports are unaffected; researchers are being routed to the Cloud VRP, AI VRP and Patch Rewards Program. What is unknown: how many AI-generated reports Google received, what share were invalid, and how much engineering time they consumed — Google has described the problem qualitatively, without publishing those figures. What is awaited: the program update Google has committed to for the first quarter of 2027, which may clarify whether OSS VRP returns, and on what terms.