Google has suspended new vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP) starting October 1, 2026. The decision follows a significant increase in low-quality, automated reports generated by AI tools, which overwhelmed human reviewers.
The company noted that many of these submissions contained hallucinations or described issues with minimal real-world impact. Because the program relies on manual triage, the volume of invalid reports created an unsustainable burden on security engineers and open-source project maintainers.
While the OSS VRP is paused, Google is directing researchers to other active initiatives, such as the Patch Rewards program. The company previously attempted to mitigate the issue in March 2026 by tightening submission criteria and updating reward policies for Android and Chrome.
Google plans to revise the submission process and expects to provide a formal update on these reforms in the first quarter of 2027. Similar challenges with AI-generated reports have also affected the Internet Bug Bounty program, Intel, and the Linux kernel maintainers.
