Google pauses product-bug reports to its open-source bug bounty after a flood of invalid automated submissions

From 1 October 2026 Google stopped accepting new product vulnerability reports to its Open Source Software Vulnerability Reward Program (OSS VRP), the bounty programme that pays outside researchers for security bugs in Google's open-source projects, BleepingComputer and Help Net Security reported. Google's own rules page and its post on X could not be read from here, so this story rests on those two outlets.

“We are temporarily no longer accepting OSS VRP product vulnerability submissions,” Google said, as quoted by BleepingComputer. “This pause is due to a significant rise in automated submissions, the vast majority of which are not valid.” Maintainers across the industry have complained about a wave of low-quality AI-generated bug reports.

The pause is partial. It does not affect OSS VRP supply-chain reports or reports already in the queue, and “This change does not affect product vulnerabilities submitted before October 1, 2026,” Google said, according to BleepingComputer. Researchers are pointed to Google's other reward programmes, including the Patch Rewards Program, which pays for security fixes to Google's open-source projects. Google said it would keep reworking this part of the programme and committed to an update in the first quarter of 2027, Help Net Security and BleepingComputer reported.

The case is a measurable example of automated output degrading a security process: a large bounty programme closed one of its intake lanes rather than sort through the volume. The date of the announcement itself is not visible from here.

• Reported Google stopped accepting OSS VRP product vulnerability submissions from 1 October 2026; earlier reports are unaffected, BleepingComputer reported. BleepingComputer
• Reported Google blamed a significant rise in automated submissions, most of them invalid, BleepingComputer reported. BleepingComputer
• Reported Google committed to an update on the programme in Q1 2027 and pointed researchers to its Patch Rewards Program, Help Net Security reported. Help Net Security