Google: Open-Source Bug Bounty Paused After Flood of AI-Generated Reports

Google has suspended new product vulnerability submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP), citing a surge of automated, largely invalid reports, according to an announcement on the company's Bug Hunters website reported by BleepingComputer on October 5, 2026. The pause applies only to product vulnerability submissions; supply-chain reports and any reports already filed remain unaffected, and Google has committed to an update on the program in the first quarter of 2027.

What was the specific vulnerability?

There is no software vulnerability in this story: the issue is an operational one, a submission channel overwhelmed by automated reports. Google stated on its Bug Hunters rules page: "We are temporarily no longer accepting OSS VRP product vulnerability submissions. This does not impact OSS VRP supply chain reports, or any outstanding reports." The company attributed the pause directly to automation, saying: "This pause is due to a significant rise in automated submissions, the vast majority of which are not valid."

The OSS VRP, launched in August 2022, covers Google-maintained open-source projects including Golang, Angular, Bazel, Protocol Buffers, and Fuchsia. It also covers repository-level issues such as GitHub Actions configurations, application configurations, and access control rules, as well as vulnerabilities in critical third-party dependencies those projects rely on. Rewards under the program range from $100 to $31,337 per accepted report, according to the program rules. The distinction Google draws in its announcement matters for researchers: the supply-chain half of the program, which covers dependency and repository configuration issues, remains open, while the product vulnerability half, which covers bugs in the projects' own code, is the part that is paused.

How was the incident detected?

The surge was detected by Google's own bug bounty triage operation, which observed the rise in automated submissions and responded by closing the product vulnerability channel. Google disclosed the pause on the Bug Hunters website, and BleepingComputer reported it on October 5, 2026. No external researcher or third party is credited with the discovery; the detection is internal to Google's vulnerability management workflow, which saw the volume of invalid automated reports rise to the point that the company judged the product submission channel unsustainable in its current form.

The episode fits a pattern the industry has documented over the past year. In January, curl's maintainer ended its HackerOne bug bounty program after being overwhelmed by AI-generated "slop" vulnerability reports. In mid-September, Intel removed all financial rewards from its Intigriti bug bounty program, without explaining the reason. In May, Microsoft warned that AI tools are accelerating vulnerability discovery industry-wide, "rais[ing] operational demands," as BleepingComputer notes in its report. Taken together, these cases describe the same failure mode: automated tooling generating vulnerability reports at a volume that human triage teams cannot process, with valid findings buried among invalid ones.

What is the current impact?

The impact is operational, not a data breach or exposure of user data. Security researchers who report product vulnerabilities in Google's open-source projects currently have no open channel for those submissions. Google's triage teams are spared further invalid reports but lose incoming valid ones until the program is reworked. The affected projects, Golang, Angular, Bazel, Protocol Buffers, Fuchsia, and critical third-party dependencies, continue to receive supply-chain related reports, which remain in scope and continue to be eligible for rewards.

Product vulnerability reports submitted before October 1, 2026 are unaffected and continue to be processed under the existing rules. Researchers still have alternatives: the Google Patch Rewards Program, which pays bounties of up to $15,000 for high-impact fixes, and the Cloud VRP, which covers repository issues in Google Cloud. According to Google's statement on the rules page, the company is "reformat[ting] and work[ing] on this aspect of the OSS VRP." The scale of the program Google is reworking is substantial: the company has paid out over $81.6 million in vulnerability rewards across all of its VRP programs since 2010, and in 2025 it paid a record $17.1 million to more than 700 researchers, a 40 percent increase from 2024's $12 million.

What are the next steps?

Google has committed to a public update in Q1 2027. Its full statement reads: "We will continue to reformat and work on this aspect of the OSS VRP and commit to giving an update in Q1 2027." Until then, the product vulnerability channel stays closed, while supply-chain reports and outstanding reports continue to be accepted.

For researchers, the practical steps are to route Google Cloud repository issues through the Cloud VRP, pursue high-impact open-source fixes through the Patch Rewards Program, and hold product vulnerability findings until the OSS VRP reopens. Reports filed before the October 1, 2026 cutoff need no action; Google has confirmed they remain in process. For the wider industry, the pause adds to a 2026 sequence, curl in January, Intel in September, Google in October, in which bug bounty programs were curtailed or restructured amid rising volumes of automated submissions. Microsoft's May warning that AI tools are raising operational demands for vulnerability triage now has a third major data point, and the Q1 2027 update will show whether Google's reworked intake process can separate valid research from automated noise.

By the numbers

Source snapshot