Google Pauses OSS VRP Product Bug Reports After Invalid Automated Submissions Surge

Google has stopped accepting new product-vulnerability submissions to its Open Source Software Vulnerability Reward Program, narrowing one of its open-source security intake channels after a surge of automated reports. The pause took effect on October 1, 2026, while supply-chain reports and reports already in the queue remain unaffected under the current OSS VRP rules.