Google pauses OSS VRP product vulnerability submissions, citing surge in invalid automated reports

TechCrunch reports that Google paused the product vulnerability submission channel for OSS VRP starting October 1, citing a significant increase in automated submissions, the vast majority of which are invalid, and plans to provide an update in the first quarter of 2027. Engineers and open source maintainers reportedly face processing burdens from AI-generated invalid reports. Secondary summaries indicate that supply chain categories and reports submitted before the pause are unaffected; this is not a shutdown of all of Google's vulnerability reward programs. Google did not provide the proportion of AI-generated reports.