Google has temporarily suspended product vulnerability submissions for its Open Source Software Vulnerability Reward Program (OSS VRP). The company announced the pause on October 1, citing a significant increase in automated vulnerability reports, the vast majority of which were invalid.
Specific Scope and Available Alternatives
The suspension specifically targets product vulnerability filings submitted to the OSS VRP on or after October 1, 2026. Submissions made prior to that date, as well as pending filings and supply chain vulnerability reports, remain unaffected by the pause.
Google noted that security researchers seeking alternative reporting routes may still submit product vulnerabilities for select Google Cloud repositories through its Cloud VRP. Security researchers can also participate in the company's Patch Rewards Program, which offers financial incentives for proactive security enhancements to open-source projects.
Responding to Automated Tooling Pressures
The decision reflects growing strain on security triage teams from automated discovery tools. Introduced in 2022 to reward researchers for finding bugs in Google's open-source software, the OSS VRP is one of several programs adjusting its rules to address AI-assisted research.
In May 2026, Google altered payout models for its Chrome and Android bounty programs. The company reduced standard Chrome rewards to favor concise submissions with concrete proof of concept, while redirecting Android incentives toward vulnerability types that automated tools struggle to identify. As part of those changes, Google raised the maximum reward for a zero-click Pixel Titan M exploit with persistence from $1 million to $1.5 million.
Industry-Wide Program Adjustments
Google is not the only organization restructuring its vulnerability rewards to cope with automated submissions. In March 2026, the HackerOne-managed Internet Bug Bounty program paused new report submissions, stating that the volume and pace of AI-assisted findings had outstripped the open-source community's ability to issue patches.
Google plans to continue reformatting the OSS VRP framework and expects to provide an update on the program's status during the first quarter of 2027.
AI-generated editorial illustration; not a documentary photograph.
Source: Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports
SIGNAL TITANS
Leave a Reply