Breaking

Google Pauses New OSS VRP Product Vulnerability Reports After Surge in Invalid Automated Submissions

October 4, 2026 at 20:46 EDT

Security
Open Source
AI Agents

Google has temporarily stopped accepting new product vulnerability submissions to its Open Source Software Vulnerability Reward Program, saying a surge of automated reports has left the review queue filled mostly with invalid findings. The pause took effect on October 1, 2026, while Google says it will keep working on the program format and provide an update in the first quarter of 2027.

October 1, 2026 · Google OSS VRP

Bug-bounty intake hits an AI triage wall

Google paused new product vulnerability submissions to OSS VRP after automated reports rose sharply and most were invalid. Supply-chain reports and already-filed reports remain outside the pause.

Oct 1

Pause took effect in 2026

Q1 2027

Promised program update

2022

OSS VRP launch year

Reward scale shows the narrowed focus

$31,337Original top OSS VRP reward

$3,133.70OT2 supply-chain max after update

The visual uses a 10-to-1 scale: Google kept prioritizing high-impact supply-chain risk while cutting lower-tier reward paths for weaker product reports.

What changed in the workflow

Automated report

Claims arrive cheaply and quickly.

→

Human triage

Maintainers still verify impact.

→

Evidence gate

Reproduction or patches matter most.

Why some support it

Invalid reports consume the same initial human review time as real findings, so stricter intake can protect maintainer capacity.

Why others worry

Narrower channels and reputation gates may make open bounty programs harder for capable newcomers to access.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.