"We are temporarily no longer accepting OSS VRP product vulnerability submissions. This does not impact OSS VRP supply chain reports, or any outstanding reports," the company said.
Google has suspended new product vulnerability submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP), citing a "significant rise in automated submissions, the vast majority of which are not valid." The OSS VRP, launched in August 2022, rewarded disclosures across Google‑maintained open-source projects — including Golang, Angular, Bazel, Protocol Buffers and Fuchsia — and for critical third‑party dependencies, repository settings such as GitHub Actions, application configurations, and access control rules. Rewards under the program ranged from $100 to $31,337, and the program was structured to prioritize flaws with the largest potential impact on the software supply chain.
Google pauses OSS VRP product submissions, keeps supply-chain reports open
The pause applies to new OSS VRP product vulnerability submissions; Google said supply‑chain reports under the OSS VRP and any outstanding reports are not affected. The company added the pause will allow it to "reformat and work on this aspect of the OSS VRP" and promised an update in Q1 2027. Google also noted that the change "does not affect product vulnerabilities submitted before October 1, 2026."
As alternatives, researchers are being directed toward other Google programs: the Google Patch Rewards Program — which pays up to $15,000 for high‑impact fixes — and Google’s Cloud Vulnerability Rewards Program for vulnerabilities in Cloud open‑source repositories that affect Cloud products.
AI‑generated spam: the proximate cause named by Google
The company attributed the suspension squarely to a flood of automated submissions, most of them false or invalid. The explanation mirrors a trend seen across other projects and vendors in the last year: an explosion of low‑quality, AI‑assisted reports that raise review costs and create operational noise.
That pattern has already forced concrete changes elsewhere. In January, the maintainer of the curl command‑line utility and library ended the project’s HackerOne bug bounty program after being overwhelmed by "a massive stream of AI slop vulnerability reports." More recently, in mid‑September, Intel removed all financial rewards for security flaws reported on its Intigriti bug bounty program; Intel has not publicly explained that decision. Microsoft, while not suspending bounty payments, warned in May that AI tools are surfacing far more vulnerabilities and that the "pace and breadth of vulnerability discovery" will increase — a shift Microsoft said "can raise operational demands." Last month, Microsoft released patches for a record‑breaking 966 flaws, including two actively exploited zero‑day vulnerabilities.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleGoogle’s broader vulnerability program record and recent payouts
Google’s engagement with external finders dates back to the company’s first Vulnerability Rewards Program in 2010. Since then, the company reported it has paid more than $81.6 million to thousands of security researchers. In 2025 Google awarded a record $17.1 million to more than 700 researchers — a 40% increase over the $12 million it paid in 2024.
What this means for open‑source maintainers, security researchers, and enterprises
Open‑source maintainers: The curl example shows a direct operational consequence of AI‑driven report volumes — projects can respond by ending public bounty programs or changing intake mechanisms. For projects maintained by large vendors, the Google pause signals a review of program rules and triage workflows to manage automated noise.
Security researchers: Google redirected researchers to the Patch Rewards Program (bounties up to $15,000) and the Cloud VRP when applicable. Researchers with product reports submitted before October 1, 2026 should see no change to those submissions.
Enterprises and procurement teams: Google emphasized that OSS VRP supply‑chain reports remain open, a targeted protection for the class of flaws most likely to affect downstream users. The episode, and the actions taken by other maintainers and vendors, highlights an operational risk: the volume of automated, low‑value reports can blunt the effectiveness of coordinated disclosure channels unless intake and validation processes are adapted.
The suspension is both a near‑term triage measure and a marker of a larger strategic problem: automated tools can accelerate discovery but also generate noise that consumes scarce reviewer time. Google has committed to redesigning the OSS VRP intake and will provide more details in Q1 2027. For now, researchers have defined alternative paths to submit high‑impact fixes, and supply‑chain reporting under the OSS VRP remains open.
