Google Freezes Open-Source Bug Bounty Product Reports Over Automated AI Submissions
Google paused product vulnerability reports in its open-source reward program after a surge of invalid, automated submissions overwhelmed triage teams.
Google has temporarily halted new product vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP), citing an unsustainable rise in automated reports that are largely invalid.
The suspension took effect on October 1, 2026, following an announcement on X by the official Google Bug Hunters account (@GoogleVRP) and an update to the program rules page. TechCrunch and Tom's Hardware reported that project maintainers and Google engineers were overwhelmed by thousands of low-quality submissions containing AI hallucinations and fabricated vulnerabilities, diverting triage capacity away from genuine software flaws.
Scope of the Freeze
The pause applies specifically to product vulnerability submissions under the OSS VRP. It does not shut down the entire initiative. According to Google's updated rules, supply chain vulnerability reports remain active, and valid reports logged before October 1 continue to be processed.
Researchers can also still report product vulnerabilities tied to Google Cloud repositories that impact Google Cloud products through the separate Google Cloud VRP. Google also directed contributors toward its other reward programs, including the Patch Rewards Program.
Next Steps in 2027
Google has not disclosed specific metrics detailing the total volume or exact percentage of invalid AI-generated submissions received prior to the pause. The company stated that it will spend time reformatting the submission process and committed to sharing an official update in the first quarter of 2027.
It remains uncertain whether Google will reopen product vulnerability submissions in early 2027 or solely provide a progress report. The exact technical gating, proof-of-concept requirements, or researcher verification mechanisms the company may introduce have not yet been specified.
I’m a techie & gamer turned SEO strategist with a genuine passion for technology, AI, science, and gaming. I love exploring new technology, following the latest developments, and looking beyond the headlines to understand what is really happening. I write about the latest tech news, trends, products, tools, and ideas shaping our digital world. What I share is not just news. My articles include my own views, observations, and practical experiences, written in a simple and useful way. At Penguin Lens, I enjoy sharing what I discover, what I think, and what I believe readers should know, with the goal of making technology easier to understand and more interesting to explore.