Reported by 4 outlets
Google halts open-source bug bounty program amid AI spam surge
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.57 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Google paused product vulnerability submissions to its Open Source Software Vulnerability Reward Program effective October 1, 2026, citing a significant rise in automated submissions, the vast majority of them invalid. The OSS VRP launched in August 2022 with rewards from $100 to $31,337 and covers Google-maintained open source including Golang, Angular, Bazel, Protocol Buffers, and Fuchsia, plus repository settings like GitHub Actions configurations and access rules.
The pause is scoped: supply chain reports and everything submitted before October 1 are still accepted, and researchers still have outlets through the Cloud VRP for Google Cloud repository issues and the Patch Rewards Program, which pays up to $15,000 for proactive fixes. Google committed to an update in Q1 2027.
This is the third such retreat in under a year. curl shut its HackerOne program in early 2026 after low-quality, often AI-generated reports overwhelmed a small team, and Intel's Intigriti program dropped bounties, reportedly for the same reason. The pattern is generative AI collapsing the cost of polished-looking but hallucinated findings until triage becomes the bottleneck, and programs respond by gating or suspending intake for everyone.
Watch what Google's Q1 2027 relaunch requires, since mandatory proof-of-concept thresholds and rate limits there will likely become the template for other large programs, and whether legitimate low-resource researchers get squeezed out by the same controls that filter the noise.
Timeline
-
original reporting
Google halts open-source bug bounty program amid AI spam surge
bleepingcomputer.com · 8d ago · October 5th, 2026
Google has now suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after being flooded by AI-generated reports. The company's OSS VRP incentivizes security researchers to responsibly disclose security flaws across open-source projects maintained by Google, including Golang, Angular, Bazel, Protocol Buffers, Fuchsia, and critical third-party dependencies, as well as repository settings like GitHub actions, application configurations, and access control rules. Google launched the OSS VRP in August 2022 with rewards ranging from $100 to $31,337, and noted that the program would focus on security flaws with the most significant impact on the software supply chain. "We are temporarily no longer accepting OSS VRP product vulnerability submissions. This does not impact OSS VRP supply chain reports, or any outstanding reports," the company said . "Why is this happening? This pause is due to a significant rise in automated submissions, the vast majority of which are not valid." However, researchers can still submit security patches for open-source software through the Google Patch Rewards Program (which offers bounties of up to $15,000 for high-impact fixes) and report vulnerabilities in Google Cloud open-source repositories that affect Cloud products through the company's Cloud VRP. Google added that it's now working on readjusting the OSS VRP to address the automated submission issues, with more information on what will change to be provided nex
-
update from gbhackers.com
Google Tightens Open-Source Bug Bounty Rules After Surge in AI-Generated Vulnerability Reports
gbhackers.com · 8d ago · October 5th, 2026
This restriction took effect on October 1, 2026, and Google plans to provide an update regarding this part of the program in the first quarter […] The post Google Tightens Open-Source Bug Bounty Rules After Surge in AI-Generated Vulnerability Reports appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from securityweek.com
Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports
securityweek.com · 8d ago · October 5th, 2026
Google has temporarily closed its Open Source Software Vulnerability Reward Program (OSS VRP) to product vulnerability submissions, saying a growing number of automated reports, most of them invalid, prompted the move. The pause was announced on X on October 1. Some product vulnerability reports may still be eligible elsewhere. Google wants bug hunters to look for impact in its other vulnerability reward programs and submit their findings there. “We will continue to reformat and work on this aspect of the OSS VRP and commit to giving an update in Q1 2027,” Google said. [ Read: Will AI Kill the Bug Bounty Industry?
-
update from malware.news
Google pauses open source bug bounty program after rise in AI submissions
malware.news · 8d ago · October 5th, 2026
Companies like Google and Microsoft are find much bigger numbers of vulnerabilities in their own products as a result of AI . But the same technology is leading to public reporting programs becoming overwhelmed by the mass submission of speculative, duplicated, or hallucinated findings. In early 2026, curl ended its HackerOne bounty program after low-quality, often AI-generated submissions overwhelmed its small security team. Intel also launched a new bug bounty program on Intigriti but there are no longer bounties available, reportedly in order to stop a flood of AI generated reports. Pros and cons Bounties can be an incentive for mass-submitting behavior when generative AI lowers the cost of producing polished-looking submissions. So, it’s understandable that companies want to limit the number of incoming reports. If most automated submissions are invalid, a temporary pause prevents Google engineers and open-source maintainers from spending disproportionate time disproving reports rather than fixing real issues. A pause gives Google the time and chance to introduce better controls, such as mandatory proof-of-concept requirements, evidence thresholds, and rate limits without letting the current