started · updated
Google pauses open source bug bounty program due to AI reports
Google has temporarily suspended product vulnerability submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP), effective October 1, 2026. The decision follows a significant surge in automated, low-quality reports generated by artificial intelligence.
According to the company, the majority of these AI-generated submissions are invalid, often containing “hallucinations” or describing non-existent security flaws. This influx has overwhelmed security engineers and open-source maintainers, forcing them to spend excessive time manually verifying speculative or duplicate findings rather than addressing critical, real-world vulnerabilities.
The suspension specifically targets product vulnerability reports. However, reports regarding the software supply chain remain active, and certain Google Cloud-related vulnerabilities can still be submitted through the Cloud VRP. Google expects to provide an update on the restructured submission framework in the first quarter of 2027.
This trend is not unique to Google; other industry players and projects, including Intel and Linux maintainers, have also reported difficulties managing the flood of AI-driven, invalid bug reports.
Entities
Google · Google Cloud · Intel · Linux · Open Source Software Vulnerability Reward Program · Open Source Software Vulnerability Rewards Program
Claims
What the coverage asserts, and how many sources carry each claim.
- [○ 1 SOURCE] Google has temporarily paused its open source bug bounty program, OSS VRP. www.malwarebytes.com
- [○ 1 SOURCE] The volume of AI-discovered vulnerabilities represents a structural increase in patch load for IT teams.
- [○ 1 SOURCE] AI-powered tools are discovering security flaws in codebases that have remained undetected for decades.
- [○ 1 SOURCE] The pause in Google's bug bounty program is caused by a significant increase in invalid automated submissions. www.malwarebytes.com
- [○ 1 SOURCE] Open-weight AI models provide malicious actors with discovery capabilities that lag only 3 to 12 months behind frontier tools.