Google pauses OSS product-bug bounty over invalid automated reports.

Google has stopped accepting product-vulnerability reports to its Open Source Software Vulnerability Reward Program (OSS VRP) as of October 1, 2026, citing what it called "a significant rise in automated submissions, the vast majority of which are not valid." The company said it will give an update in the first quarter of 2027.

The notice, posted on Google's OSS VRP rules page and in an October 1 post from the @GoogleVRP account, covers new product-vulnerability submissions only. Google said the change does not affect OSS VRP supply-chain reports, outstanding reports, or product vulnerabilities submitted before October 1. It pointed researchers to its other VRP programs and the Patch Rewards Program, and said some Google Cloud repos that affect Cloud products may still take product-vulnerability reports through the Cloud VRP. Neither the post nor the rules notice gives a date for reopening.

The same change removed the payouts. The GitHub commit that added the notice on September 30 replaced the product-vulnerability reward ranges for Google's top two project tiers, $500 to $7,500 and $101 to $3,133.7, with dashes. Supply-chain and other security-issue rows in the reward table still list dollar amounts.

Google's wording is "automated," not "AI." TechCrunch and BleepingComputer framed the flood as AI-generated reports. Google's post gave no figures on volume or on how the reports were produced.

Google's Go project had already moved on the same problem. On September 2, Go added a section to its security policy asking reporters not to send LLM-generated reports "without proper curation," and saying a reporter "forwarding large quantities of LLM output indiscriminately" will not receive credit. Curl, which BleepingComputer reported ended its HackerOne bug bounty in January after a stream of AI slop reports, now says on its disclosure-policy page that it has no bug bounty, while still taking vulnerability reports through HackerOne.

Bug bounties pay outside researchers to find flaws before attackers do, and Google has closed one of those lanes rather than keep sorting through automated submissions it says are mostly invalid. Until the Q1 2027 update, researchers who find product bugs in Google's open-source code have no OSS VRP payout to chase.