Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports

* Google temporarily closed the OSS VRP for product vulnerability submissions.
* The pause was due to a significant rise in automated submissions, most of which were invalid.
* The pause was announced on X on October 1.
* The pause only covers product vulnerabilities.
* The pause does not impact supply chain reports or pending reports.
* Product vulnerabilities submitted before October 1, 2026, are unaffected.
* Reports impacting Google Cloud products may still be accepted through the Cloud VRP.
* Researchers can submit findings to other programs, such as the Patch Rewards Program.
* Google plans to update and work on the OSS VRP, committing to an update in Q1 2027.

The pause in the OSS VRP reflects a tension between automated discovery methods driven by AI and the community's established verification processes. The shift signals a recognition that the speed of automated reporting is outpacing the community's ability to validate findings effectively, as evidenced by similar pauses in related programs like the Internet Bug Bounty program which faced similar pressures from AI-assisted discoveries. This creates a structural challenge where incentives for discovery must be recalibrated when the input stream shifts from human-driven diligence to machine-driven volume. The distinction made between product vulnerabilities and supply chain reports suggests an effort to triage risk based on the perceived reliability of the submission source. The commitment to reformat the program by Q1 2027 suggests an attempt to integrate these new dynamics rather than simply halt activity, forcing a pivot in how vulnerability value is assessed—moving focus from raw volume to validated impact and proactive remediation, as seen in the adjustments made to Chrome and Android reward programs. This dynamic forces observers to question whether relying on reward systems designed for human-centric security discovery can remain viable when automated tools rapidly scale the threat landscape.
Bridge Questions: If automated validation becomes the dominant metric for triage, what new forms of human expertise will be valued over raw report volume? How should organizations design reward structures to incentivize both rapid discovery and rigorous, verifiable analysis simultaneously? What are the long-term implications for the necessary skill set in security research if automated systems can handle initial scanning?