Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports

Google's OSS VRP, launched in 2022 to reward vulnerabilities in its open source projects, has been temporarily closed to new product vulnerability submissions as of October 1, 2026. The closure is a response to a significant rise in automated vulnerability reports, most of which are invalid. This measure is limited to product vulnerabilities and excludes supply chain vulnerability reports and any reports submitted before the pause. Google directs researchers to other reward programs for submitting valid findings and plans to reform the OSS VRP with an update expected in Q1 2027. This pause aligns with broader industry trends addressing the impact of AI tools on vulnerability discovery and reporting.

The temporary suspension of product vulnerability submissions to the OSS VRP may slow the intake of new vulnerability reports for Google's open source projects, potentially delaying identification and remediation of new product vulnerabilities through this channel. However, supply chain vulnerability reports and pending submissions remain unaffected. Researchers still have alternative avenues to report vulnerabilities impacting Google Cloud products and open source projects. There is no indication of active exploitation or increased risk due to this pause.

No direct mitigation is required by defenders as this is an operational change by Google in its vulnerability reward program. Researchers should submit product vulnerability reports through alternative Google programs such as the Cloud VRP or Patch Rewards Program. Organizations relying on OSS VRP reports should monitor updates from Google, with a planned update expected in Q1 2027. There is no impact on existing reports or supply chain vulnerability submissions.