Google has paused its Open Source Software Vulnerability Rewards Program (OSS VRP), citing a significant increase in automated submissions, most of which the company said were invalid.
Google said the programme was suspended from October 1 and that it plans to provide an update in the first quarter of 2027.
The programme rewards security researchers who identify and report vulnerabilities in Google’s open-source software.
Google cites rise in automated submissions
In a post on X and an update to the programme’s rules, Google said the pause was prompted by a “significant rise in automated submissions”.
The company said the “vast majority” of those submissions were not valid.
Reports about the programme’s suspension said Google engineers and open-source maintainers had been dealing with a growing number of reports containing incorrect findings or AI-generated claims that did not correspond to actual vulnerabilities.
The development highlights a growing challenge for bug bounty programmes as generative AI tools make it easier to produce large numbers of automated security reports.
AI-generated reports raise concerns
Cybersecurity researchers have previously warned that AI-generated or low-quality vulnerability reports could place additional pressure on bug bounty programmes.
Security teams must assess submitted reports to determine whether a reported vulnerability is genuine, reproducible and significant.
A large volume of inaccurate submissions can consume researchers’ and maintainers’ time while making it harder to identify legitimate security issues.
Google’s decision to pause the open-source programme means researchers will temporarily be unable to submit new qualifying reports under the programme’s existing reward structure.
Other Google bug bounties remain available
While the OSS VRP is paused, Google has encouraged participants to consider its other vulnerability reward programmes.
The company has not announced a permanent closure of the open-source programme.
Google said it would provide further information during the first quarter of 2027.
