Google has announced a major update to its Open Source Software Vulnerability Reward Program (OSS VRP). Starting October 1, 2026, the company will stop accepting reports regarding product vulnerabilities through this specific channel. Submissions made before this deadline will remain unaffected by the new policy.
The decision follows a surge in low-quality reports that have overwhelmed Google engineers and open-source maintainers. According to reports, thousands of submissions claiming to identify critical vulnerabilities were found to be AI-generated hallucinations. These invalid reports have diverted significant resources away from addressing genuine security threats.
Despite the changes to the OSS VRP, Google will continue to accept certain vulnerability reports through its Cloud Vulnerability Reward Program (Cloud VRP). This applies specifically to reports concerning code repositories that impact Google Cloud products.
Google intends to use this period to restructure and optimize the mechanisms governing its open-source security programs. The company plans to provide an update on the progress of these improvements in the first quarter of 2027.
