Google's open source bug bounty is the first to buckle: as of October 1, 2026, Google has paused new product vulnerability reports for its Open Source Software Vulnerability Rewards Program (OSS VRP), citing a significant rise in automated submissions, the vast majority of which are not valid. Google announced the decision on social media and on the program's official page, promising an update in the first quarter of 2027.
What exactly is paused
The freeze is narrower than the headline suggests. Reports filed before October 1 continue to be processed. The supply-chain part of OSS VRP, which covers tampered build pipelines and poisoned packages, keeps running. For some repositories tied to Google Cloud products, researchers can still file product flaws through Cloud VRP instead. What is closed is the most-used route: find a code flaw in one of Google's public projects, write it up, and get paid.
In Google's own words, the pause is due to a significant rise in automated submissions, most of them invalid. According to Tom's Hardware, Google engineers and open source maintainers were overwhelmed by reports whose vulnerability details simply did not exist, a classic output of model hallucination. TechCrunch reported the pause on October 4, 2026.
Why bug bounties broke first
A vulnerability report cannot be judged by how professional it reads; someone has to reproduce and verify it. That step used to be backed by the submitter's reputation: people willing to spend hours writing a report had usually confirmed the bug themselves. Once AI tools cut the cost of writing a report to nearly zero, that default trust collapsed. A polished report citing files and line numbers now takes minutes to generate, while the maintainer's verification cost has not dropped at all.
The cost asymmetry flipped completely: submitters produce in bulk, reviewers defuse one by one. Genuinely severe reports risk being buried in the pile, with longer waits for everyone. For a security program that lives on outside researchers, being flooded is worse than silence.
What researchers should do now
Google's notice suggests exploring its other reward programs in the meantime. In practice, researchers have three options: keep sending supply-chain findings to OSS VRP, route Google Cloud product flaws through Cloud VRP, or wait for the first-quarter 2027 update for pure product bugs while turning to other vendors' still-open programs.
The more telling question is what the reopened rules will look like. The industry broadly expects harder gates, such as mandatory reproducible proof and per-account submission limits. The signal is clear: AI-generated content is forcing every collaboration mechanism built on human review to redesign its front door, and bug bounties are simply the first large program to hit pause.
