Google pauses product vulnerability submissions to its open-source bug bounty after a surge of mostly invalid automated reports

Why it matters

【Key points】

On October 1 Google's official bug bounty account, @GoogleVRP, said it is temporarily no longer accepting product vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP), which covers Google-maintained projects such as Go, Angular and Protocol Buffers. The reason given: "a significant rise in automated submissions, the vast majority of which are not valid." Supply chain reports and reports filed before October 1 are unaffected. Google committed to an update in Q1 2027 but gave no reopening date.

【Verifiable】

The announcement is in the @GoogleVRP post of October 1; the program rules page later carried the same notice, and SecurityWeek, BleepingComputer and The Hacker News covered it from October 5. Google gave no figures and did not explicitly say the submissions were AI-generated, only "automated." Per Google's program page, product vulnerabilities in flagship projects paid $500 to $7,500, and supply chain compromises up to $31,337. According to The Hacker News, Google began requiring stronger proof in some tiers in March 2026, and the Go project added a section on LLM-generated reports to its security policy in early September. According to SecurityWeek, Google changed Chrome and Android rewards in May, and HackerOne's Internet Bug Bounty paused new submissions in March.

【Our read】

The point is not that one bounty program paused, but that AI has made vulnerability reports cheap enough to break bounty economics: filing costs almost nothing, while verifying still costs maintainer time, and rewards encourage volume. Keeping supply chain reports open suggests the flood is in the category tools can guess at in bulk. Watch whether programs move to proof machines cannot easily fake, such as working reproductions or merged patches, and whether vendors' own scanners cut false positives. Until then, the gap between finding bugs at scale and fixing them falls on maintainers.