Google Pauses Open-Source Bug Bounty as AI Spam Floods In

Google has temporarily stopped accepting vulnerability submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP). The reason, the company says, is a sharp rise in automated reports — the vast majority of which turned out to be invalid.

Launched in August 2022, the OSS VRP rewards researchers for responsibly disclosing flaws in Google's open-source projects — including Golang, Angular, Bazel, Protocol Buffers and Fuchsia — as well as in critical third-party dependencies and repository settings such as GitHub Actions configurations, application settings and access-control rules. Payouts ranged from $100 to $31,337, with priority given to flaws with the greatest impact on the software supply chain.

"We are temporarily no longer accepting OSS VRP product vulnerability submissions. This does not impact OSS VRP supply chain reports, or any outstanding reports," the company said, attributing the pause to the significant rise in automated submissions.

Researchers still have other routes: they can send patches for open-source software through the Patch Rewards Program (up to $15,000 for high-impact fixes) or report flaws in Google Cloud open-source repositories via Cloud VRP. Google says it is reworking the OSS VRP to tackle the automated-submission problem and promises details in Q1 2027. The change does not affect product vulnerabilities submitted before October 1, 2026.

An industry-wide ailment

Google's program numbers are striking: since its first VRP launched in 2010, the company has paid researchers more than $81.6 million. In 2025 a record $17.1 million went to over 700 participants — up 40% from 2024.

Google is not the first to buckle under a flood of low-quality AI-generated reports. In January, the maintainer of the curl utility and library shut down its HackerOne program, overwhelmed by a stream of "AI slop." In mid-September, Intel stripped all cash rewards from its Intigriti program — though it has yet to explain why.

Microsoft has not taken a comparable step, but warned back in May that AI tools surface far more vulnerabilities, driving up the "pace and breadth" of discovery across the industry and raising operational demands. Last month it shipped patches for a record 966 flaws, including two actively exploited zero-days.

Source: Bleeping Computer