Google Temporarily Halts Product Vulnerability Submissions in OSS VRP
Google has announced a temporary pause on accepting product vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP), citing a significant increase in automated reports, the vast majority of which are invalid. The announcement was made on X on October 1, 2026, and applies only to product vulnerabilities within the OSS VRP. The company emphasized that this change does not affect supply chain vulnerability reports or any reports already submitted prior to the pause.
According to Google, submissions made before October 1, 2026, remain eligible for review and potential rewards under the existing terms. The pause is specifically targeted at product vulnerabilities in Google’s open source projects and does not extend to other categories within the program.
Scope and Limitations of the Pause
Google clarified that the pause is limited to product vulnerability reports and does not impact its supply chain reporting channel. Reports concerning supply chain vulnerabilities in open source dependencies continue to be accepted and processed as usual. Additionally, any reports already in the submission pipeline before the announcement date will continue to be evaluated under standard procedures.
The company noted that for certain Google Cloud repositories affecting Google Cloud products, product vulnerability reports may still be accepted through the Cloud Vulnerability Reward Program (Cloud VRP). This provides an alternative pathway for researchers focusing on cloud-specific impacts.
Alternative Programs Encouraged for Bug Hunters
Google is directing security researchers to its other vulnerability reward programs as alternatives for submitting findings. Researchers are encouraged to consider the Cloud VRP for cloud-related issues or the Patch Rewards Program, which offers incentives for proactive security improvements in open source projects, such as submitting patches or enhancements that strengthen project resilience.
The Patch Rewards Program, unlike traditional bug bounties, focuses on preventive measures rather than vulnerability disclosure, aligning with Google’s broader strategy to improve open source security through proactive contributions.
Context: Recent Changes Across Google’s Reward Programs
This adjustment to the OSS VRP follows similar modifications Google made earlier in 2026 to its Chrome and Android vulnerability reward programs. In May, Google reduced standard payouts for Chrome vulnerabilities, shifting focus toward concise, high-quality reports that include concrete proof of exploitability. The change was motivated by the increasing use of AI tools to generate low-volume, automated submissions.
For the Android program, Google announced a strategic shift to prioritize vulnerability types that are less susceptible to automated discovery by AI. As part of this effort, the reward for a zero-click exploit targeting the Pixel Titan M chip with persistence was increased from $1 million to $1.5 million, reflecting the higher complexity and value of such findings.
Broader Industry Trend: AI Impact on Bug Bounty Programs
Google’s move is part of a wider trend in the bug bounty ecosystem, where the proliferation of AI-assisted vulnerability discovery has led to overwhelming volumes of submissions, many lacking validity or actionable detail. In March 2026, the Internet Bug Bounty (IBB) program, administered by HackerOne, similarly paused new submissions due to the inability of volunteer maintainers to keep pace with the speed and volume of AI-generated reports.
The OSS VRP was launched in 2022 to incentivize the discovery of vulnerabilities in Google’s open source software portfolio. Since its inception, the program has played a role in strengthening the security of critical open source components used across Google’s products and services.
Future Outlook and Commitment to Program Improvement
Google stated that it will continue to rework and refine the OSS VRP framework to better handle the evolving landscape of vulnerability reporting. The company committed to providing an update on the status and future direction of the program in the first quarter of 2027.
This pause reflects Google’s effort to maintain the integrity and effectiveness of its bug bounty initiatives amid rising automation, ensuring that rewards are directed toward meaningful, high-impact security contributions rather than noise generated by automated tools.
Source: SecurityWeek