Google paused new product-vulnerability submissions to its open-source bug bounty effective October 1, 2026.
Why it matters: The change narrows where security researchers can submit reports to a major open-source vulnerability program. It also highlights the review burden created by automated or low-quality submissions.
- The pause covers new product-vulnerability reports to Google’s Open Source Software Vulnerability Rewards Program, or OSS VRP.
- Google said the vast majority of automated submissions were invalid.
- Supply-chain reports and cases submitted before October 1 remain unaffected.
- Google plans to provide an update in the first quarter of 2027.
Google temporarily stopped accepting new reports about product vulnerabilities in its Open Source Software Vulnerability Rewards Program, or OSS VRP, effective October 1, 2026.
Google said the pause followed a significant rise in automated submissions, “the vast majority of which are not valid.” Google’s announcement did not provide the size of the influx, the share of reports rejected, reviewer hours or the cost of reviewing and prioritizing them, known as triage.
The pause does not shut down all of Google’s open-source security-reward work. Google’s program rules say reports submitted under its supply-chain category remain eligible, as do outstanding reports submitted before the pause. Researchers can also use other Vulnerability Rewards Programs and Google’s Patch Rewards Program. Some vulnerabilities involving Google Cloud repositories and affecting Google Cloud products may still qualify through the Google Cloud VRP.
Google changed the program’s rules earlier in 2026. In an April update, it cited reports with incorrect or hallucinated explanations of how a vulnerability could be triggered, as well as coding errors without meaningful security impact or reachable code paths. The changes removed monetary rewards or credit for certain lower-tier product-vulnerability and other-security-issue reports.
Google’s announcement used the broader term “automated submissions.” TechCrunch and Tom’s Hardware covered that announcement and described the submissions as largely AI-generated or invalid. Those reports are not independent verification of Google’s figures.
Google said it will continue reworking this part of the program and provide an update in the first quarter of 2027.
By the numbers
- October 1, 2026 - effective date of the pause
- Q1 2027 - planned timing for Google’s program update
- Vast majority - Google’s description of the automated submissions it said were invalid
Yes, but: Google did not quantify the submission increase, invalid-report share, reviewer workload or triage costs. Its announcement also referred to automated submissions, while the AI-specific characterization came from secondary coverage.
What's next: Google plans to provide an update on the program in the first quarter of 2027.