TechCrunch AI, Help Net Security AI · 4 sourcesTechCrunch AI · 4 sources · 4 reports · Google pauses OSS VRP submissions due to ineffective AI reports
Starting October 1, 2026, Google stopped accepting new product vulnerability reports through the Open Source Software Vulnerability Rewards Program (OSS VRP), citing a significant increase in automated submissions, the vast majority of which are invalid and mainly AI-generated, overwhelming review engineers and open source maintainers. The program covers the latest versions of public repositories and repository configurations under Google's GitHub organizations, including projects such as Go, Angular, and Protocol Buffers. Google explained the reason for the pause in an X post and plans to announce subsequent adjustments in the first quarter of 2027. The rules page has removed product vulnerability reward amounts of $500 to $7,500 for flagship projects and $101 to $3,133.7 for important projects. Supply chain poisoning reports are still accepted; vulnerabilities involving Google Cloud products can be submitted to Cloud VRP instead; reports submitted before October 1 are unaffected. Google did not provide the proportion of AI-generated reports.
