Google has temporarily halted its Open Source Software Vulnerability Rewards Program, which offers financial incentives to researchers for identifying security flaws in the company's open-source projects. The decision follows a surge in automated reports generated by artificial intelligence models.
The company stated that these AI-driven submissions frequently contain technical hallucinations and false positives, overwhelming the review process. As a result, Google stopped accepting new vulnerability reports starting October 1, 2026, to address the influx of inaccurate data.
The suspension currently applies only to the open-source software program, while other vulnerability reward initiatives remain operational. Google expects to provide an update regarding the potential restart of the program no earlier than the first quarter of 2027.
