Google has temporarily halted its Open Source Software Vulnerability Reward Program (OSS VRP) for product vulnerability submissions, saying a growing number of automated reports, most of which were invalid, prompted the move.
The break was announced on X on October 1st.
“This pause is due to a significant increase in automated submissions, the vast majority of which are invalid,” Google said.
Only product vulnerabilities are affected by the pause. Google says this will not impact the program’s supply chain reports or any pending reports.
“This change does not impact product vulnerabilities reported before October 1, 2026,” the company noted in an update Program page.
Some product vulnerability reports may still be acceptable elsewhere. “For some Google Cloud repos that impact Google Cloud products, we may continue to accept product vulnerability reports through the Cloud VRP,” Google said.
Google wants bug hunters to search for impacts in its other vulnerability reward programs and submit their results there. Researchers can also turn to the Patch Rewards program, which offers rewards for proactively improving the security of open source projects.
“We will continue to reformatte and work on this aspect of the OSS VRP and are committed to providing an update in the first quarter of 2027,” Google said.
( Read: Will AI destroy the bug bounty industry? )
Launched in 2022, the OSS VRP pays researchers for vulnerabilities found in Google’s open source projects.
The OSS VRP pause follows changes Google made to its Chrome and Android rewards programs in May in response to the increasing use of AI vulnerability detection tools.
Chrome’s default payouts have been reduced because the company prefers concise reports that provide concrete evidence of the existence of a bug. For Android, Google announced it would prioritize vulnerability types that are harder for AI tools to find, and the top reward for a zero-click Pixel Titan M exploit with persistence increased from $1 million to $1.5 million.
In March, the Internet Bug Bounty (IBB) program run by HackerOne paused new submissions, saying the speed and volume of AI-powered vulnerability discoveries had outpaced the open source community’s ability to provide fixes.
Related: Google paid out $17 million in bug bounty rewards in 2025
Related: Microsoft Bug Bounty Program: Paid $20 million to 500 researchers
Related: OpenAI launches bug bounty program for abuse and security risks
