Google has temporarily halted the intake of new submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) following an influx of machine-generated vulnerability reports. The program, which encourages security researchers to identify and report flaws in open-source projects under Google's stewardship, covers codebases such as Golang, Angular, Bazel, Protocol Buffers, and Fuchsia, as well as third-party dependencies and infrastructure elements including GitHub actions, application settings, and access controls.
Since its debut in August 2022, the OSS VRP has offered bounties between $100 and $31,337, with emphasis on vulnerabilities affecting the software supply chain most significantly. Google announced the suspension with the statement: "We are temporarily no longer accepting OSS VRP product vulnerability submissions. This does not impact OSS VRP supply chain reports, or any outstanding reports. Why is this happening? This pause is due to a significant rise in automated submissions, the vast majority of which are not valid."
Researchers retain alternative pathways for contributing to Google's security initiatives. The Google Patch Rewards Program continues to accept submissions, offering up to $15,000 for high-impact patches, and the Cloud VRP remains open for vulnerabilities affecting Google Cloud open-source repositories and cloud products. Google stated that it is revising the OSS VRP framework to mitigate the automated submission problem, with plans to announce changes in the first quarter of 2027.
In an update posted to the Bug Hunters website, Google noted: "We will continue to reformat and work on this aspect of the OSS VRP and commit to giving an update in Q1 2027. In the meantime, we encourage you to find impact across our other VRP programs and submit there instead, or pursue the Patch Rewards Program. This change does not affect product vulnerabilities submitted before October 1, 2026."
Google's decision reflects a broader pattern affecting the bug bounty ecosystem. Since establishing its first vulnerability rewards program in 2010, Google has distributed over $81.6 million to thousands of researchers. The company achieved a record payout of $17.1 million in 2025 to more than 700 researchers, representing a 40% jump from 2024's $12 million total.
Industry-wide struggle with AI-generated submissions
Google is not alone in confronting this challenge. The curl project's maintainer discontinued its HackerOne bug bounty program in January after being inundated with low-quality AI-generated vulnerability submissions. Intel took a more drastic step in mid-September, eliminating all monetary incentives for security reports submitted through its Intigriti bug bounty platform, though the company has not publicly detailed its reasoning.
Microsoft, while maintaining its bug bounty operations, flagged the issue in May, warning that artificial intelligence tools are accelerating vulnerability discovery and cautioning that this trend will "increase across the software industry" and "can raise operational demands." The company released patches for 966 vulnerabilities last month, including two zero-day flaws under active exploitation.