Google Pauses Open-Source Bug Bounty Program After Surge in AI-Generated Reports

Google has temporarily paused product vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP) after seeing a significant increase in automated reports, most of which were reportedly invalid.

The suspension took effect on October 1, 2026, and Google says it plans to reassess the program before providing an update in the first quarter of 2027.

Why Did Google Pause the Bug Bounty Program?

Google's OSS VRP rewards security researchers who discover and responsibly report vulnerabilities in Google's open-source projects.

However, the company says it has recently experienced a major increase in automated submissions. The overwhelming majority of these reports were not valid, creating additional work for security teams that need to investigate and verify each reported vulnerability.

The increase is closely associated with the growing use of generative AI and automated security tools for vulnerability research.

AI can analyze large amounts of source code quickly, but it can also generate incorrect findings or misunderstand how a particular piece of software works. As a result, a report may identify something that looks like a security problem without demonstrating a real-world vulnerability.

AI Is Changing Bug Hunting

Artificial intelligence has become increasingly popular among cybersecurity researchers because it can help analyze source code and identify potential security weaknesses much faster than traditional manual methods.

However, Google's experience highlights an important limitation: finding a suspicious piece of code isn't the same as proving that it is exploitable.

Google previously changed its OSS VRP rules in 2026 to require stronger evidence for certain vulnerability reports. For some high-priority projects, researchers may need to provide reproducible evidence through OSS-Fuzz or a merged patch.

The company also warned that AI-generated reports can contain incorrect information or "hallucinations" about how vulnerabilities could actually be triggered.

Which Reports Are Affected?

The temporary suspension specifically applies to product vulnerability submissions through the OSS VRP.

Google says the change does not affect:

• Reports submitted before October 1, 2026
• Open-source supply-chain compromise reports
• Outstanding reports already submitted
• Certain vulnerabilities that may qualify through other Google security programs

Researchers are being encouraged to explore Google's other Vulnerability Reward Programs while the OSS VRP is being reviewed.

Google's Open-Source Projects Remain in Focus

Google's open-source ecosystem includes widely used projects such as Go, Angular, Flutter, Bazel and Protocol Buffers.

The company's OSS VRP divides projects into different tiers based on their importance and security impact. Earlier changes introduced stricter requirements for some lower-priority projects and increased the emphasis on high-impact, verifiable vulnerabilities.

The goal is to ensure that security teams spend their time investigating vulnerabilities that could genuinely affect users and organizations.

Google Plans Changes for 2027

Google hasn't announced exactly how the OSS VRP will change when product vulnerability submissions eventually reopen.

The company has committed to providing an update during Q1 2027 while it works on restructuring this part of the program. There is currently no confirmed date for when normal product vulnerability submissions will resume.

The pause could lead to stronger verification requirements, improved automated filtering or additional evidence requirements for researchers.

Other Security Communities Are Facing Similar Challenges

Google isn't the only organization dealing with an increase in low-quality automated security reports.

Security communities around projects such as Linux and other open-source software have also reported challenges associated with AI-generated vulnerability reports. The broader issue is that automated tools can produce findings at a scale that human security teams cannot easily review.

This creates a difficult balance: AI can potentially help researchers discover legitimate vulnerabilities faster, but poorly verified automated reports can consume valuable time.

What This Means for Security Researchers

For researchers participating in Google's programs, the temporary pause means product vulnerabilities in Google's open-source projects may need to be submitted through alternative channels where applicable.

Google's decision also reinforces the importance of human verification when using AI for cybersecurity research.

Researchers can use AI to investigate code, generate hypotheses and identify potentially vulnerable areas, but security reports still need evidence demonstrating that the issue is real, reproducible and has meaningful security impact.

Conclusion

Google's decision to temporarily pause product vulnerability submissions through its open-source bug bounty program highlights a growing challenge for cybersecurity in the AI era.

Generative AI can dramatically increase the speed of vulnerability research, but large numbers of inaccurate or unverified reports can overwhelm security teams.

Google plans to provide an update in Q1 2027, and the changes it introduces could influence how security researchers use AI-assisted vulnerability discovery in the future.