Google has temporarily halted new product vulnerability submissions for its Open Source Software Vulnerability Rewards Program (OSS VRP) following a significant surge in automated, low-quality filings. Announced on October 1, 2026, the temporary suspension comes as security review teams struggle to handle an overwhelming volume of invalid reports generated by artificial intelligence tools.
Scope of the Suspension and Next Steps
The pause specifically affects new product vulnerability reports submitted under Google's open-source program through the end of the year. The company confirmed that existing outstanding reports and supply chain vulnerability submissions under the OSS VRP remain unaffected. Furthermore, security researchers can still submit findings to Google's other bug reward programs without interruption.
Google plans to use the temporary pause to overhaul its intake process and reformulate how incoming reports are evaluated, with an updated policy status scheduled for release in Q1 2027.
Low-Quality AI Submissions Burden Security Triage
While advanced AI models can accelerate valid vulnerability discovery for defenders, security maintainers increasingly report that unverified automated tools generate hallucinations, incomplete context, and unsubstantiated claim lists. Security researchers utilizing basic prompts with minimal human verification often output flawed submissions that severely strain review resources.
An August 2026 study by 1Password's Off-by-1 Labs highlighted the current limitations of automated security fixes, finding that nearly half of AI-generated patches failed to remediate existing exploit paths, while others altered expected application behavior or introduced fresh security defects.
Widespread Industry Strain Across Open-Source Projects
Google is not the first organization to adjust its bug bounty intake due to automated noise. Open-source developers behind the curl command-line project terminated their HackerOne bounty initiative in late January 2026 after receiving a constant stream of invalid, AI-driven reports.
Similarly, Linux security list maintainers reported in May 2026 that identical automated tools were generating massive duplication and overwhelming reviewers with low-value communications, drawing vital focus away from genuine flaw remediation across the developer ecosystem.
AI-generated editorial illustration; not a documentary photograph.
Source: Google benches open source bug bounty program following ‘significant rise’ in AI submissions
SIGNAL TITANS
Leave a Reply