Google pauses OSS VRP bug bounty program as low-quality AI-generated vulnerability reports surge

Google has stopped accepting new product vulnerability reports through its Open Source Software Vulnerability Rewards Program (OSS VRP) because a large number of invalid AI-generated submissions overwhelmed review engineers and open source maintainers. In an official X post, Google said the pause stems from a significant increase in automated submissions, the vast majority of which are invalid. OSS VRP is Google's bug bounty program for open source software it releases, including projects such as Go, Angular, and Protocol Buffers. It launched in 2022 and pays security researchers who privately report flaws in code, repository settings, and supply chain components. Reports submitted before October 1 are unaffected, and some Google Cloud repositories affecting Cloud products can still receive reports through Cloud VRP. Google said it will continue to adjust OSS VRP and committed to an update in the first quarter of 2027. In the meantime, researchers can submit findings to other VRP programs or the Patch Rewards Program.