Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports
Google pauses Open Source Software Vulnerability Reward Program due to automated reports.
Google has temporarily halted submissions to its Open Source Software Vulnerability Reward Program (OSS VRP) due to a surge in invalid, automated vulnerability reports. This pause specifically affects product vulnerabilities and does not impact supply chain reports or pending submissions. The company plans to re-evaluate and update the program in Q1 2027, encouraging researchers to focus on other reward programs like Patch Rewards.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonGoogle's Open Source Software Vulnerability Reward Program was forced into a temporary halt because a surge of invalid, AI-generated or automated vulnerability submissions overwhelmed the review process, making it difficult to identify genuine security findings. This highlights a growing challenge in the security community: as automation tools lower the barrier to submission, the signal-to-noise ratio in vulnerability disclosure programs deteriorates. When reviewers are buried in junk reports, real vulnerabilities risk being overlooked or delayed, increasing exposure time. It also wastes critical security researcher resources and erodes the effectiveness of crowdsourced security as a defensive layer.
