Google stopped accepting product vulnerability reports through the bug bounty for its open source software on October 1. According to the program’s rules and an announcement on X, as relayed by Help Net Security, the pause is due to a significant rise in automated submissions, the vast majority of which are not valid. Supply chain reports and anything filed before October 1 are not affected.
Google has not said how long the pause will last. The Hacker News notes that neither the post nor the rules page gives a date for taking such reports again, while other coverage says Google promised an update in the first quarter of 2027. An update is not a reopening date, so researchers should treat the pause as open-ended for now.
What the pause covers
The program is called the Open Source Software Vulnerability Reward Program, or OSS VRP. According to SecurityWeek, it was introduced in 2022 and pays researchers for vulnerabilities found in Google’s open source projects.
Under its rules, a product vulnerability is a design or implementation flaw in Google’s open source software that substantially affects the confidentiality or integrity of user data in software built with that code. Those are the reports that are now closed. Supply chain compromises, which are weaknesses in how a project is built or released, are still accepted. So are reports already submitted, including product reports filed before October 1.
Why Google says it did it
Google’s own wording points to automation, not to a specific technology. The Hacker News adds that the company did not say whether the submissions were produced with AI tools. Other outlets, including Help Net Security and Infosecurity Magazine, tie the surge to AI-generated reports, and say it follows months of complaints from open source maintainers about low-quality submissions.
The imbalance explains why the problem grows. A convincing-looking report now takes seconds to produce, while checking whether the flaw is real still takes a human reviewer’s time. According to reports on the pause, many of the invalid submissions contained hallucinated details, meaning flaws that do not exist.
Part of a wider retreat
The OSS VRP change is not Google’s first adjustment. SecurityWeek notes that in May the company changed its Chrome and Android reward programs in response to AI-assisted vulnerability discovery. Standard Chrome payouts were reduced, as Google began favoring concise reports with concrete proof that a bug exists. For Android, it said it would prioritize vulnerability types that are harder for AI tools to find, and the top reward for a zero-click Pixel Titan M exploit with persistence rose from $1 million to $1.5 million.
Taken together, the changes suggest a shift from rewarding volume to rewarding evidence.
Where researchers can still report
Researchers are not left without options, though they are narrower. Supply chain reports remain open under the same program. Google also points to its Patch Rewards Program, which, according to The Hacker News, pays between $100 and $15,000 for security patches to the projects it covers. That program rewards fixes, not vulnerability reports.
Some vulnerabilities in Google’s open source projects that are closely tied to Google Cloud or AI products are directed to the Cloud VRP or the AI VRP, Infosecurity Magazine reports. The notice does not say whether Google will still read product vulnerability reports that come without a reward, so anyone planning to report should check the program rules page first.
What this means for you
If you are a security researcher, a product flaw in a Google open source project no longer earns a bounty for now. Supply chain findings and patches are the routes that still pay. Reports that are short, reproducible and backed by proof are the kind programs are moving toward.
If you maintain open source software, the story is a reminder that report triage costs real time. Clear submission requirements, such as a working proof of concept, can filter out much of the noise.
If you only use software built on Google’s open source code, nothing changes in what you run. It is our interpretation, not Google’s statement, that fewer outside researchers will have a financial reason to examine these projects for product flaws while the pause lasts. The practical response is the usual one: keep dependencies updated and follow each project’s own security advisories.
What to watch next
The pause leaves a few open questions. Google has not published a reopening date, has not said how it will tell valid reports from automated ones when it returns, and has not said whether product reports without a reward will still be reviewed. Its promised update in 2027 will show whether the program comes back with stricter rules.
For now, the useful takeaway is that bug bounty programs built for human researchers are being tested by machine-generated volume, and Google’s answer so far is to stop the flow and redesign the intake.
