Google has officially suspended its Open Source Software Vulnerability Rewards Program, effective October 1. The company cited a substantial increase in automated submissions as the primary reason for this decision, noting that the vast majority of these reports are invalid.
According to reports, Google engineers and open source maintainers have struggled to manage the influx of submissions, many of which contain AI-generated hallucinations. This operational strain forced the company to halt the program to address the quality of incoming data.
The company confirmed that the pause will remain in effect until at least the first quarter of 2027. Google plans to provide further updates on the status of the program at that time, while encouraging researchers to participate in its other existing bug bounty initiatives.
