Google has temporarily paused part of its Open Source Software Vulnerability Reward Program (OSS VRP) after a sharp increase in invalid, AI-generated bug reports overwhelmed security teams and open-source maintainers.
The pause took effect on October 1, 2026, and applies to new product vulnerability submissions under the OSS VRP. Google said the decision will give its security teams time to redesign the submission process and deal with the growing number of automated reports.
Google announced the change on X and said it plans to provide an update in the first quarter of 2027.
What is still active?
The pause does not mean the entire OSS VRP has been closed. Google will continue accepting supply chain vulnerability reports submitted through the program.
The company will also continue handling valid product vulnerability reports that were submitted before October 1.
Some vulnerabilities affecting Google Cloud products may also be submitted through the separate Google Cloud Vulnerability Reward Program.
Google is encouraging security researchers to use its other active vulnerability reward programs or its Patch Rewards Program while the OSS VRP product submission system is being redesigned.
Why did Google pause the program?
The main reason is the growing number of automated submissions. Google said that the vast majority of these reports are not valid.
AI-powered tools can scan software and generate vulnerability reports quickly. While these tools can help researchers find real security problems, large numbers of inaccurate reports can also create extra work for security engineers and open-source maintainers.
The issue has also affected other parts of the software industry. Linux maintainers previously faced a surge in bogus CVE submissions, while the number of recorded vulnerabilities reached unusually high levels.
Intel has also recently paused its bug bounty program, although the company did not officially say that AI-generated submissions were the reason.
Google’s latest move shows how AI is changing cybersecurity. AI tools can help discover real bugs faster, but security teams are now also looking for better ways to separate useful reports from automated noise.
