Google Pauses Open Source Bug Bounty Over Fake AI Reports

The Open Source Software Vulnerability Reward Program (OSS VRP) is a specialized cybersecurity bug bounty initiative managed by Google. Designed to reward external security researchers for finding security flaws in open-source projects, the program incentivizes community-driven vulnerability discovery to protect the broader software supply chain. Google announced a temporary freeze on new vulnerability submissions for the OSS VRP due to an overwhelming influx of automated, invalid artificial intelligence submissions that disrupted maintainer triage operations.

Key Facts

Attribute Value

Program Name Open Source Software Vulnerability Reward Program (OSS VRP)

Managing Entity Google

Operational Status Temporarily paused for new submissions (existing submissions unaffected)

Primary Reason for Pause Influx of automated, invalid AI-generated vulnerability reports

Alternative Programs Available Cloud VRP, AI VRP, Patch Rewards Program

Next Scheduled Update Q1 2027

Why Did Google Pause the Open Source Software Vulnerability Reward Program?

Google paused the Open Source Software Vulnerability Reward Program due to a significant rise in automated submissions, the vast majority of which were invalid. Thousands of AI-generated reports created unexploitable hallucinations, forcing engineers to spend critical time manually validating code rather than addressing authentic, high-severity vulnerabilities across open-source software repositories.

According to Google’s official announcement, the freeze addresses an unsustainable volume of automated filings. Reporting from Tom’s Hardware detailed the direct operational toll on maintainers:

“Google engineers and open-source maintainers were reportedly being overwhelmed by thousands of these poorly written reports that claimed to find bugs but were actually completely invalid or unexploitable hallucinations. They ended up spending too much time manually validating code instead of actually fixing real, critical vulnerabilities”. Tom’s Hardware

While intake for new reports is suspended, Google confirmed that the temporary pause will not affect previously submitted reports currently in the pipeline.

Google suspended intake for the OSS VRP after thousands of invalid, AI-generated reports forced engineers to spend critical hours validating hallucinations instead of patching authentic vulnerabilities.

How Are AI Hallucinations Impacting Cybersecurity Bug Bounty Programs?

Artificial intelligence hallucinations impact bug bounty programs by producing superficially convincing reports that contain fabricated technical flaws. Large language models generate plausible-sounding submission narratives that waste triage resources, overwhelming security teams who must verify non-existent flaws and diverting attention away from legitimate software vulnerabilities across the entire cybersecurity industry.

The issue reflects a broader trend across cybersecurity operations. As reported by TechCrunch, industry experts previously warned that automated “AI slop” would exhaust vulnerability coordination teams. Vlad Ionescu, co-founder and CTO of RunSybil, described the deceptive nature of these submissions:

“people are receiving reports that sound reasonable, they look technically correct … It turns out it was just a hallucination all along. The technical details were just made up by the LLM”. Vlad Ionescu, Co-founder and CTO of RunSybil, via TechCrunch

Security teams face systemic exhaustion because large language models generate technically plausible bug reports with completely fabricated vulnerability details.

How It Compares

Google has isolated this suspension exclusively to the OSS VRP, leaving its other security reward programs fully operational. Security researchers are explicitly encouraged to redirect their testing efforts toward active programs that remain open for submissions.

Program Name Current Status Accepted Activity / Focus

Open Source Software VRP (OSS VRP) Paused (New submissions suspended) Product vulnerability submissions paused; existing reports processed

Google Cloud VRP Active Cloud infrastructure vulnerability research

Google AI VRP Active Artificial intelligence system security research

Patch Rewards Program Active Rewarding qualifying security patches and remediation

While Google frozen new submissions to the OSS VRP, its Cloud VRP, AI VRP, and Patch Rewards Program remain active and open to security researchers.

Common Questions

When will Google reopen the OSS VRP?

Google has not guaranteed a return date. The company committed to reformatting the program and providing an official operational update in Q1 2027, leaving the exact reopening timeline unknown.

Are existing bug submissions affected by the OSS VRP freeze?

No, existing submissions are not affected. Google stated that while it is not accepting new incoming reports, the temporary pause will not disrupt the evaluation or processing of previously submitted claims.

Which alternative Google reward programs can researchers use?

Researchers can contribute to Google’s Cloud VRP, AI VRP, and Patch Rewards Program. Google actively recommends these alternatives while the open-source program undergoes structural reformatting.

Sources and Methodology

This article synthesizes verified reporting and public disclosures from Google VRP announcements, Tom’s Hardware, TechCrunch, and Lowyat.NET. Information regarding AI-generated submission volumes and engineer workload was corroborated using primary maintainer statements and industry analysis. No currency, unit, or language conversions were applied; all proper nouns and direct quotes remain verbatim from source records. This article was last updated on October 5, 2026.