Google freezes open-source bug bounty after flood of invalid automated reports

Google has stopped accepting new product vulnerability reports for its Open Source Software Vulnerability Rewards Program (OSS VRP), the company announced in an update to the programme's rules. According to BleepingComputer and Help Net Security, the pause took effect on October 1, 2026, and Google attributed it directly to a wave of machine-generated reports. The company said the move is "due to a significant rise in automated submissions, the vast majority of which are not valid."

Help Net Security reported that many of the submissions contained hallucinated findings, while others described issues with negligible real-world impact. Triaging them still consumes engineer time, which is the cost that forced the decision.

What happened

BleepingComputer reported that OSS VRP launched in August 2022 and covered security flaws in Google-maintained open-source projects including Golang, Angular, Bazel, Protocol Buffers and Fuchsia, as well as their third-party dependencies and repository settings. Payouts ranged from $100 to $31,337 depending on the severity and the importance of the affected project.

The freeze is not a shutdown of the whole programme. According to both publications, supply chain reports under OSS VRP are unaffected, and any report submitted before October 1 continues to be processed. Google said it will provide an update in the first quarter of 2027 on how the programme will be adjusted to handle automated submissions.

Who is affected

Researchers who relied on OSS VRP for product-level findings now have narrower options. BleepingComputer reported that they can still submit security fixes through the Google Patch Rewards Program, which pays up to $15,000 for high-impact patches, and report flaws in Google Cloud open-source repositories through Cloud VRP.

The wider effect falls on the disclosure process itself. When a well-funded programme has to close its intake, maintainers of smaller projects, who have no triage team at all, are left with the same problem and fewer resources. BleepingComputer noted that the curl project ended its bug bounty programme in January after being flooded with machine-written reports, and that Intel removed financial rewards for vulnerability reports in September. Microsoft has separately warned that automated tooling is sharply increasing the rate at which vulnerabilities are found and reported across the industry.

What to do

For organisations running their own disclosure or bounty programmes, the practical lesson is in the intake rather than the payout. Reports that cannot be reproduced consume the same triage capacity as real ones, so requiring a working reproduction case, a clear impact statement and an affected version before a report enters the queue removes most of the load before an engineer sees it. Programmes that pay per valid finding can also tie reputation or submission limits to a researcher's historical accuracy.

For researchers, the change raises the bar on evidence. A report that arrives with a verified reproduction and a concrete impact assessment is now what separates a submission that gets read from one that gets closed, and that applies well beyond Google's programme.