Skip to content
MONTEGRE
Sign in
BREAKING
/Laotian Man Released from Eswatini Prison After Year-Long US Deportation/Spanish police clear 3,000 migrants from Ceuta beach camp/Trump Names Katie Zacharia as New White House Press Secretary/Belgian Student Protests Spread to Brussels After Week of Unrest in Liège/Delhi Police Detain Journalists Covering CJP Protest Despite Press Cards/Turkey Launches 7,818 Operations Against Organized Crime in Eight Months/Laotian Man Released from Eswatini Prison After Year-Long US Deportation/Spanish police clear 3,000 migrants from Ceuta beach camp/Trump Names Katie Zacharia as New White House Press Secretary/Belgian Student Protests Spread to Brussels After Week of Unrest in Liège/Delhi Police Detain Journalists Covering CJP Protest Despite Press Cards/Turkey Launches 7,818 Operations Against Organized Crime in Eight Months

Google pauses open-source bug bounty after AI-generated report flood

The company suspended new vulnerability submissions on October 1 after reviewers were overwhelmed by low-quality, automated reports.

Sources: Numerama, Silicon, Biobío Chile3 sources ↓|· 1 min read
Google pauses open-source bug bounty after AI-generated report flood
Photo: Numerama

KEY POINTS

  • Google suspended OSS VRP product vulnerability submissions on October 1, 2026
  • AI-generated reports overwhelmed reviewers with invalid and hallucinated findings
  • Supply-chain vulnerability reports and Cloud VRP submissions remain accepted
  • Program paid up to $31,000 for critical flaws; restructuring targeted for Q1 2027
  • Researchers redirected to Patch Rewards Program during the pause

Google has temporarily halted new submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after a surge of AI-generated reports flooded the intake system. The pause took effect on October 1, 2026, and applies specifically to product vulnerability reports, while supply-chain vulnerability reports continue to be accepted.

According to Google, the vast majority of recent submissions were produced automatically by AI tools and did not describe valid security flaws. Reviewers were unable to manage the volume of invalid reports, which often contained hallucinated data or irrelevant code snippets.

“The vast majority of submissions are not valid.”

— Google VRP team via X

The program previously paid up to $31,000 for critical vulnerabilities discovered by legitimate researchers. Google stated it aims to restructure the product vulnerability track by the first quarter of 2027 and directed researchers toward its Patch Rewards Program in the meantime.

Exceptions remain for projects feeding the Google Cloud ecosystem, which fall under the separate Cloud Vulnerability Reward Program. Earlier in 2026, Google had already introduced a four-tier priority system for open-source projects to manage report quality.

READ THE FULL STORYat Numerama

2 more sources below

TOPICS

#Technology#Artificial Intelligence#Cybersecurity#Software

COMMENTS (0)

0/2000

No comments yet. Be the first.

RELATED STORIES

Economy4 sources

EU Approves Greece Energy Escape Clause Unlocking 1 Billion Euro Investment

European Commission endorses Greek request for fiscal flexibility on energy security spending through 2028.

Agenda6 sources

TSE orders suspension of pro-Lula WhatsApp channel over disinformation

Justice Nunes Marques ruled the "Exército do Lula" channel coordinated mass falsehoods against Flávio Bolsonaro and gave Meta three hours to comply.

Economy3 sources

IMF, World Bank Meet in Bangkok Amid Iran War, Energy Shock

Global finance leaders gather in Thailand as Middle East conflict, soaring oil prices, and rising debt cloud growth outlook.

This page was compiled with AI assistance from the outlets named above and passed an automated language check before publication. Montegre has no reporters of its own; the byline names the outlets the story was compiled from. Method and editorial standards