Google has suspended its vulnerability reward program following a spate of invalid reports ...

Google has suspended accepting vulnerability reports for its products under the Open Source Software Vulnerability Bounty Program (OSS VRP). The reason for this was a massive influx of poor-quality AI-generated bug reports, Tom's Hardware reports .

The company announced its decision on the X social network, saying it will release an update on the program's future in the first quarter of 2027.

📢 PSA for open-source bug hunters We are temporarily no longer accepting OSS VRP product vulnerability submissions. This does not impact OSS VRP supply chain reports, or any outstanding reports. As an alternative, we encourage you to find impact across our other VRP programs and submit there instead, or pursue the Patch Rewards Program. Why is this happening? This pause is due to a significant rise in automated submissions, the vast majority of which are not valid. We will continue to reformat and work on this aspect of the OSS VRP and commit to giving an update in Q1 2027. — Google VRP (Google Bug Hunters) (@GoogleVRP) October 1, 2026

📢 PSA for open-source bug hunters We are temporarily no longer accepting OSS VRP product vulnerability submissions. This does not impact OSS VRP supply chain reports, or any outstanding reports. As an alternative, we encourage you to find impact across our other VRP programs and submit there instead, or pursue the Patch Rewards Program. Why is this happening? This pause is due to a significant rise in automated submissions, the vast majority of which are not valid. We will continue to reformat and work on this aspect of the OSS VRP and commit to giving an update in Q1 2027.

The suspension only applies to new vulnerability reports submitted after October 1. Reports submitted earlier remain valid. Google clarified that some cloud service reports may continue to be accepted through the Cloud VRP if they relate to repositories that impact Google Cloud products. The program also continues to accept reports regarding the OSS VRP supply chain.

The OSS VRP was created to encourage independent researchers to find and responsibly disclose vulnerabilities in Google’s open source projects. This used to require significant effort and professional skills, but with the proliferation of large language models and automated AI scripts, the process has become cheap and fast, leading to an avalanche of superficial and inaccurate reports.

Google engineers and open-source developers reported receiving thousands of such reports, often containing fabricated errors or unusable “hallucinations.” This forced them to spend a lot of time manually reviewing the code instead of fixing real critical issues. This overload was the main reason the program was suspended.

Similar situations have already arisen at other companies. In particular, Linux developers previously said they were "completely stunned" that AI tools were discovering a record 2,000 vulnerabilities in each kernel release.

Intel has also suspended its own bug bounty program , which offered up to $100,000 for bug fixes. While the company has not officially confirmed that AI reports caused the issue, experts suspect that is the case.