Google pauses open-source bug bounty submissions after a flood of invalid AI-generated reports

Google has paused part of its Open Source Software Vulnerability Reward Program (OSS VRP) — the bug bounty that pays outside researchers for finding security flaws in Google’s open-source projects. The pause took effect on 1 October 2026, the day Google announced it on X and on the program’s website, and was reported by Tom’s Hardware on 3 October and TechCrunch on 4 October.

Why

Google blamed automation. In its words, the pause is due to “a significant rise in automated submissions, the vast majority of which are not valid.” According to Tom’s Hardware, Google engineers and open-source maintainers were being overwhelmed by thousands of low-quality reports that claimed to find bugs but turned out to be invalid, unexploitable or simply hallucinated — so time went into checking reports rather than fixing real problems.

What exactly is paused

• New product-vulnerability submissions (code defects, logic or design flaws in Google’s public repositories) are suspended.
• Reports submitted before 1 October are not affected.
• Supply-chain reports to the OSS VRP are still accepted, and some issues in Google Cloud repositories can still go to the Cloud VRP, Tom’s Hardware reported.
• Google said it will give an update in the first quarter of 2027 and pointed researchers to its other bounty programs.

Wider trend

Cheap large language models and automated bug-hunting scripts have made it almost effortless to generate vulnerability reports, and the problem is not unique to Google. Tom’s Hardware notes that Linux kernel maintainers recently described themselves as overwhelmed by AI-driven bug reports, and that Intel also suspended a bounty program paying up to $100,000 per flaw — although Intel did not say AI submissions were the reason.