Google is suspending reports under its Open Source Vulnerability Rewards Program (OSS VRP) starting October 1, 2026. The decision was made due to an abnormal surge in reports generated using artificial intelligence, most of which turned out to be invalid.
Google is suspending reports under its Open Source Vulnerability Rewards Program (OSS VRP) starting October 1, 2026. The decision was made due to an abnormal surge in reports generated using artificial intelligence, most of which turned out to be invalid.
The company’s security team announced this on the official Google Bug Hunters blog. The suspension will be in effect until at least early next year, with updated details about the future program to be released in the first quarter of 2027.
The change applies to Google open source projects, but all reports submitted before October 1, 2026 will be processed according to the previous rules. For repositories related to cloud technologies and artificial intelligence, experts advise using specialized directions — Cloud VRP and AI VRP or applying through the Patch Rewards program.
"The suspension is due to a significant increase in the number of AI-related reports, the vast majority of which are invalid," Google Bug Hunters said. The company also emphasizes that it is prioritizing the integration of important projects with the OSS-Fuzz system for reliable and scalable detection of memory errors.
It has previously been reported that the Linux kernel and other major open source development community is also facing a massive influx of poor-quality and false vulnerability reports created using AI.
