Google pauses open-source bug bounty after AI-generated report flood

Google has temporarily halted new submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after a surge of AI-generated reports flooded the intake system. The pause took effect on October 1, 2026, and applies specifically to product vulnerability reports, while supply-chain vulnerability reports continue to be accepted.

According to Google, the vast majority of recent submissions were produced automatically by AI tools and did not describe valid security flaws. Reviewers were unable to manage the volume of invalid reports, which often contained hallucinated data or irrelevant code snippets.

“The vast majority of submissions are not valid.”

The program previously paid up to $31,000 for critical vulnerabilities discovered by legitimate researchers. Google stated it aims to restructure the product vulnerability track by the first quarter of 2027 and directed researchers toward its Patch Rewards Program in the meantime.

Exceptions remain for projects feeding the Google Cloud ecosystem, which fall under the separate Cloud Vulnerability Reward Program. Earlier in 2026, Google had already introduced a four-tier priority system for open-source projects to manage report quality.