Google has officially suspended its Open Source Software Vulnerability Reward Program (OSS VRP) for product vulnerability submissions. The decision took effect on October 1, following a significant increase in low-quality reports generated by artificial intelligence. These automated submissions, which often contain hallucinations or invalid claims, have overwhelmed Google engineers and maintainers, diverting resources from addressing genuine security threats.
The suspension specifically targets product vulnerability reports, while supply chain reports remain unaffected. Google noted that it may continue to accept certain product vulnerability submissions through its Cloud VRP for specific repositories impacting Google Cloud products. Reports submitted prior to the October 1 deadline will still be processed by the company.
The industry is facing a broader trend of AI-driven spam in security reporting. Linux kernel maintainers recently reported being overwhelmed by a record 2,000 vulnerabilities per release, largely attributed to AI-powered bug-hunting tools. Additionally, Intel has suspended its own bug bounty program, which previously offered rewards of up to $100 000 per identified security flaw.
