Google has temporarily stopped accepting product vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP), effective October 1, 2026. The company said the pause followed "a significant rise in automated submissions, the vast majority of which are not valid," while reporting across multiple outlets has tied the surge to AI-generated reports.
Google announced the change in a post on X on October 1 and on its Bug Hunters website. It described the stop as temporary and committed to providing an update on the program's restructuring in the first quarter of 2027, while making clear that this is not a commitment to resume submissions on a specified date.
The suspension does not cover every category. Supply chain compromise reports remain eligible under the OSS VRP, and product vulnerability reports submitted before October 1 continue to be processed. Google also directed researchers to other active channels, including the Cloud Vulnerability Reward Program for certain Google Cloud repositories and the Patch Rewards Program, which pays $100 to $15,000 for security patches.
The move follows an earlier tightening of the rules. In March 2026, after observing a significant increase in AI-generated submissions, Google began requiring stronger evidence for certain categories, including reproducible results through OSS-Fuzz or a merged patch, particularly for memory corruption reports in the top two project tiers. Lower-priority tiers lost eligibility for rewards and credit for some product vulnerability reports. The latest suspension goes further by halting new product vulnerability submissions entirely while Google reworks that part of the program.
Google itself continues to use AI in security work. In July 2026, the company said its Chrome security teams were using AI to improve vulnerability discovery, triage, and patching at a much larger scale.
The decision reflects broader strain across the industry. Apple set a limit on the number of vulnerability reports researchers could submit in August 2026. HackerOne stopped accepting new submissions for its Internet Bug Bounty Program in March 2026. Intel suspended financial rewards for security flaws reported through its Intigriti program around September 2026, with industry analysts attributing the decision to AI-driven low-quality submissions, though Intel did not publicly confirm AI as the reason. The curl project ended its bug bounty program in January 2026 after being overwhelmed by AI-generated reports that did not constitute actual flaws. Linux kernel maintainers said they were "completely overwhelmed" by AI-powered bug hunters pushing the kernel to a record roughly 2,000 vulnerabilities per release, forcing the project to abandon support for legacy network drivers. Microsoft warned in May 2026 that AI tools would increase the "pace and breadth of vulnerability discovery" across the software industry and "can raise operational demands" on corporate security personnel.
Launched in August 2022, the OSS VRP covers Google-owned open-source projects including Go, Angular, Bazel, Protocol Buffers, and Fuchsia, along with critical third-party dependencies and repository configurations such as GitHub Actions and access-control rules. The program previously offered rewards of $500 to $7,500 for product vulnerabilities in flagship projects and $101 to $3,133.7 for important projects; those amounts were removed from the public rules on September 30, one day before the suspension was announced.
What remains confirmed: the pause is temporary rather than a permanent cancellation, supply chain reports stay open, and earlier submissions are unaffected. What remains unknown: how many reports were received, what proportion were AI-generated, how much engineering time was spent verifying them, and what the revised rules will look like. What is awaited: Google's update in the first quarter of 2027.
As AI lowers the cost of producing plausible-looking vulnerability reports, the cost of proving or disproving them remains human-intensive, leaving disclosure programs to work out how to separate genuine flaws from automated noise.